CVE-2023-2499: metagauss registrationmagic Improper Authentication
Vulnerability summary
CVE-2023-2499 is a critical (CVSS 9.8) Improper Authentication vulnerability in metagauss registrationmagic. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 70.2% of scored vulnerabilities. Fixed in 5.2.1.1.
Timeline
- 16-05-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.1.0. This is due to insufficient verification on the user being supplied during a Google social login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.30%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
0.00 pp
From 1.30% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
Affected systems
Metagauss2 products
Wordpress1 product
- custom-registration-form-builder-with-submission-manager≤ 5.2.1.0 (fixed in 5.2.1.1)
2 vendors · 3 products