CVE-2021-4073 RegistrationMagic <= 5.0.1.7 Authentication Bypass

What is CVE-2021-4073?

CVE-2021-4073 is a critical authentication bypass vulnerability in RegistrationMagic, published on 14 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.

Weakness: CWE-287

Which versions are affected by CVE-2021-4073?

It affects 1 product.

Products include Metagauss Registrationmagic.

How do I fix CVE-2021-4073?

No fix has been published for CVE-2021-4073 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-4073 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-4073 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in RegistrationMagic

• CVE-2017-20208 RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection Critical 9.8
• CVE-2024-10508 Auth bypass in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Critical 9.8
• CVE-2023-2499 RegistrationMagic <= 5.2.1.0 - Authentication Bypass Critical 9.8
• CVE-2024-1990 SQL injection in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login High 8.8
• CVE-2024-1991 Privilege escalation in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3858-cvv4-qvj7.