RegistrationMagic WordPress Plugin PHP Object Injection Vulnerability

A PHP Object Injection vulnerability has been identified in the RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress. This vulnerability affects all versions prior to 3.7.9.3 (exclusive) and arises from the deserialization of untrusted input in the is_expired_by_date() function. The flaw allows unauthenticated attackers to inject a PHP object, which can be exploited to fetch a remote file and install it on the vulnerable site.

Impact

Exploitation of this vulnerability allows for PHP Object Injection, which can be leveraged to execute arbitrary code or actions on behalf of the injected object, potentially leading to a full site takeover.

Remediation

Users are advised to update the RegistrationMagic WordPress plugin to version 3.7.9.3 or later.