CVE-2024-1991

Name of the Vulnerable Software and Affected Versions RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress versions up to, and including, 5.3.0.0

Description The issue is related to a missing capability check on the update users role() function, which allows authenticated attackers with subscriber-level access and above to escalate their privileges to that of an administrator.

Recommendations For versions up to, and including, 5.3.0.0, update to a version that includes a fix for the missing capability check on the update users role() function. As a temporary workaround, consider restricting access to the update users role() function until a patch is available.