CVE-2017-20208 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all…
Critical CVSS: 9.8

CVE-2017-20208

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
Vendor
Metagauss
Product
Registrationmagic
CWE
CWE-502
Yayın Tarihi
2025-10-18 04:15:59
Güncelleme
2025-12-19 22:15:11
Source Identifier
security@wordfence.com
KEV Date Added
-

Kategoriler

CWE-502 Registrationmagic CRITICAL Metagauss 2025

Referanslar

https://plugins.trac.wordpress.org/changeset/1733274/custom-registration-form-builder-with-submission-manager https://www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/ https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b79193-f8fc-4ea2-8973-fe292cfb926b?source=cve