{"id":"CVE-2024-1991","aliases":["EUVD-2024-17707","GHSA-33x5-jqpp-33fv"],"status":"published","title":"RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \u003c= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation","description":"The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00891,"percentile":0.59718,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-04-09T18:58:59Z","modified":"2026-06-17T07:05:36Z","products":[{"vendor":"metagauss","product":"registrationmagic"},{"vendor":"metagauss","product":"registrationmagic – custom registration forms, user registration, payment, and user login"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/766e3966-157a-4db3-9179-813032343f76?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/trunk//services/class_rm_user_services.php#L1205","tags":["x_transferred","Product"]},{"url":"https://plugins.trac.wordpress.org/changeset/3049490/custom-registration-form-builder-with-submission-manager#file24","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1991"},{"url":"https://github.com/advisories/GHSA-33x5-jqpp-33fv"}],"sources":{"cve":[{"id":"CVE-2024-1991","title":"RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \u003c= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation","description":"The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator","status":"published","published":"2024-04-09T18:58:59.144Z","modified":"2026-04-08T17:01:30.836Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:18.597034Z"}],"euvd":[{"id":"EUVD-2024-17707","description":"The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator","status":"published","published":"2024-04-09T18:58:59Z","modified":"2026-04-08T17:01:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:53.403695Z"}],"ghsa":[{"id":"GHSA-33x5-jqpp-33fv","title":"The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login...","description":"The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator","status":"published","published":"2024-04-09T21:31:59Z","modified":"2025-01-31T03:32:13Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:59:43.882222Z"}],"nvd":[{"id":"CVE-2024-1991","description":"The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator","status":"published","published":"2024-04-09T19:15:21.883Z","modified":"2026-06-17T07:05:36.447Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:09:49.255123Z"}]}}