CVE-2021-4073
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including administrators, if they knew a valid username on the site due to missing identity validation in the social login function social_login_using_email() of the plugin. This affects versions equal to, and less than, 5.0.1.7.
- Affected products
- Registrationmagic
- Metagauss Registrationmagic
- ≤ 5.0.1.7
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 7.0% (94th percentile)
- Weakness
- CWE-287
- NVD status
- Modified
- Published
- 2021-12-14
Fix
Update to version 5.0.1.8, or newer.
CVE-2021-4073 at NVD
No indexed exploits for CVE-2021-4073 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2021-4073 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.