← Back

CVE-2017-20208

nvd nist
Published: Oct 18, 2025Modified: Dec 19, 2025

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: security@wordfence.com (Secondary)

Description

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.

Affected (1)

Metagauss
1 product
Registrationmagic
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Registrationmagic
Before 3.7.9.3

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

Source: security@wordfence.com
Patch
Source: security@wordfence.com
Press/Media CoverageThird Party Advisory
Source: security@wordfence.com
Technical Description

Timeline

No history available yet.