VulnTitan VulnTitan Security command center
Vulnerability Report
Plugin Critical Patch path listed CVE-2020-9456

RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege Escalation

In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.

Quick Answer

CVE-2020-9456 is a critical severity with CVSS 9.9 Privilege Escalation issue affecting the Plugin RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. It affects Versions before 4.6.0.4 and is fixed in 4.6.0.4.

Back to Feed View Plugin Hub Open CVE Reference
Published
Mar 05, 2020
Last Updated
Jan 22, 2024
Slug
custom-registration-form-builder-with-submission-manager
Operational Summary

What the operator needs to know

Share Email
Patch Status
Patched release is available
Remediation
Update to version 4.6.0.4, or a newer patched version
Operator Briefing

CVE-2020-9456 is tracked for the Plugin RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login as critical severity with CVSS 9.9. The affected range is Versions before 4.6.0.4. Update RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login to 4.6.0.4 or newer where that version is compatible with the site.

Issue Type
Privilege Escalation
Primary Fixed Version
4.6.0.4
Primary Affected Range
Versions before 4.6.0.4
Tracking ID
CVE-2020-9456
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/241dc2e4-b079-407b-b610-c40b23d038cb?source=api-prod
Detailed Metadata
Software Type Plugin
Software Slug
custom-registration-form-builder-with-submission-manager View on wordpress.org
CVE CVE-2020-9456
Patched Versions
4.6.0.4
Affected Versions
Versions before 4.6.0.4
Related CVE Cluster

Related CVEs for RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

These internal links group the same WordPress plugin by CVE, issue type, severity, and patch status so operators and search engines can connect the full vulnerability cluster.

Critical CVE-2020-9457 4.6.0.4 Mar 05, 2020
CVE-2020-9457 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Privilege Escalation

RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation

Critical CVE-2026-24373 6.0.7.2 Mar 12, 2026
CVE-2026-24373 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Vulnerability

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass

Critical CVE-2025-15403 6.0.7.2 Jan 16, 2026
CVE-2025-15403 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Privilege Escalation

RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

Critical CVE-2024-10508 6.0.2.7 Nov 08, 2024
CVE-2024-10508 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Privilege Escalation

RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

Critical CVE-2023-2499 5.2.1.1 May 15, 2023
CVE-2023-2499 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Vulnerability

RegistrationMagic <= 5.2.1.0 - Authentication Bypass

Critical CVE-2021-4073 5.0.1.8 Dec 08, 2021
CVE-2021-4073 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Vulnerability

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

Critical CVE-2017-20208 3.7.9.3 Oct 02, 2017
CVE-2017-20208 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Vulnerability

RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection

High CVE-2024-1990 5.3.2.0 Mar 26, 2024
CVE-2024-1990 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login SQL Injection

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode

Licensing Notices

This record contains material that is subject to copyright

DEFIANT
Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more

MITRE
Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more