Cyber Resilience

CVE-2024-10508

Critical

Published: 09 November 2024

Published
09 November 2024
Modified
29 January 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1533 94.8th percentile
Risk Priority 29 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-10508 is a critical-severity Improper Handling of Missing Values (CWE-230) vulnerability in Metagauss Registrationmagic. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The RegistrationMagic – User Registration Plugin with Custom Registration Forms for WordPress is vulnerable to privilege escalation via account takeover in all versions through 6.0.2.6. The root cause is insufficient validation of password reset tokens in the login controller before allowing a password update, which permits modification of any user account including administrators.

Unauthenticated attackers can exploit the flaw over the network by supplying a crafted or absent token to reset arbitrary passwords, thereby gaining full access to affected accounts. The issue carries a CVSS 3.1 score of 9.8 and is tracked under CWE-230.

A fix was committed in changeset 3181174 to the plugin's class_rm_login_controller.php, and Wordfence has published corresponding threat intelligence. The EPSS score has remained flat at 0.1533 with no material increase observed after disclosure.

EU & UK References

Vulnerability details

The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password…

more

reset token prior to updating a user's password. This makes it possible for unauthenticated attackers to reset the password of arbitrary users, including administrators, and gain access to these accounts.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

metagauss
registrationmagic
≤ 6.0.2.7

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References