Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-20208

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.

Published

2025-10-18T04:15:59.477

Last Modified

2025-12-19T22:15:11.043

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Secondary
CWE-502

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	metagauss	registrationmagic	< 3.7.9.3	Yes

References

https://plugins.trac.wordpress.org/changeset/1733274/custom-registration-form-builder-with-submission-manager Patch ([email protected])
https://www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/ Press/Media Coverage, Third Party Advisory ([email protected])
https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b79193-f8fc-4ea2-8973-fe292cfb926b?source=cve Technical Description ([email protected])