CVE-2023-23976 WordPress RegistrationMagic plugin <= 5.1.9.2 - Arbitrary Price Change
Attackers can arbitrarily change prices due to incorrect default permissions in the RegistrationMagic plugin, affecting WordPress sites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-23976?
CVE-2023-23976 is a high-severity vulnerability in Metagauss RegistrationMagic, published on 24 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.1.9.2.
Weakness: CWE-276
Which versions are affected by CVE-2023-23976?
It affects 1 product.
Products include Metagauss Registrationmagic.
How do I fix CVE-2023-23976?
No fix has been published for CVE-2023-23976 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-23976 being exploited?
There is no known exploitation of CVE-2023-23976 in the wild and no public exploit code.
Other vulnerabilities in Metagauss RegistrationMagic
- CVE-2017-20208 RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
- CVE-2024-10508 Auth bypass in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- CVE-2023-2499 RegistrationMagic <= 5.2.1.0 - Authentication Bypass
- CVE-2021-4073 RegistrationMagic <= 5.0.1.7 Authentication Bypass
- CVE-2024-1990 SQL injection in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Sources
Also known as GHSA-4qj3-r8v4-x3fg.