CVE-2024-10508

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Improper Handling of Missing Values pada metagauss registrationmagic. Skor CVSS 3.1 9.8 (Critical) menurut wordfence.com.

Deskripsi (NVD)

The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts.

Rincian

Terbit di NVD

9 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-230: Improper Handling of Missing Values

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/3181174/custom-registration-form-builder-with-submission-manager/... patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c4679fa7-be6b-4f50-8cdf-ff9822794f19?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.2... product
• https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.2... product