CVE-2017-20208

CRITICAL

RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2017-20208 has a selected CVSS score of 9.8 (critical).

Description

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 2, 2017 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 20, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

Browse metagauss / RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

Default status: unaffected

CVE ListBefore 3.7.9.3affected

registrationmagic

Browse metagauss / registrationmagic
VulnCheckVersion data not supplied

References

4