CVE-2020-9457: metagauss registrationmagic Missing Authorization
Vulnerability summary
CVE-2020-9457 is a critical (CVSS 9.9) Missing Authorization vulnerability in metagauss registrationmagic. EPSS estimates a 2.53% chance of exploitation in the next 30 days, higher than 84.7% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 4.6.0.4.
Timeline
- 06-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
2.53%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.53% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Metagauss1 product
- registrationmagic≤ 4.6.0.3
Wordpress1 product
- custom-registration-form-builder-with-submission-manager≤ 4.6.0.3 (fixed in 4.6.0.4)
2 vendors · 2 products
References
4 links- wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/X Refsource MISCThird Party Advisory
- www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/X Refsource MISCExploitThird Party Advisory