PT-2021-22951 · WordPress · Registrationmagic

Ayecode Ltd · CVE-2021-4073 · Published 2021-12-14 · Updated 2025-12-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RegistrationMagic WordPress plugin versions prior to 5.0.1.7

Description The issue allows unauthenticated users to log in as any site user, including administrators, if they know a valid username on the site. This is due to missing identity validation in the social login using email() function of the plugin.

Recommendations For versions prior to 5.0.1.7, update to version 5.0.1.7 or later to resolve the issue. As a temporary workaround, consider disabling the social login using email() function until a patch is available. Restrict access to the social login feature to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-4073

Affected Products

Registrationmagic

References · 6

• 🔥 https://wordfence.com/blog/2021/12/authentication-bypass-vulnerability-patched-in-user-registration-plugin · Exploit
• https://plugins.trac.wordpress.org/changeset/2635173/custom-registration-form-builder-with-submission-manager/trunk/services/class_rm_user_services.php · Patch
• https://osv.dev/vulnerability/CVE-2021-4073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4073 · Security Note
• https://wordfence.com/vulnerability-advisories/#CVE-2021-4073 · Note
• https://twitter.com/pdnuclei_bot/status/1996127296621871552 · Twitter Post