High severity · published Mar 6, 2020
CVE-2020-9458
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and…
8.8
CVSS
2.5%
EPSS
No
On KEV
Description
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Registrationmagic · Metagauss
through 4.6.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9458
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9458
Third Party Advisory
https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/#developers
Third Party Advisory
https://wpvulndb.com/vulnerabilities/10116
Exploit
https://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/
More from Registrationmagic
9.8
CVE-2026-73341
WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability
9.8
CVE-2026-49764
WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability
9.8
CVE-2017-20208
RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
9.8
CVE-2024-10508
RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery
9.8
CVE-2024-25935
WordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerability