Critical · published December 14, 2021
🚨 A sneaky flaw in the RegistrationMagic plugin lets unauthorized users log in as any site member, including admins, with just a known username! 🔥 Think of this vulnerability as a party where anyone can stroll in just by knowing the name on the guest list. If they know a valid username, they're in — no invitation needed! This is absolutely devastating! An attacker could waltz right in, access sensitive data, change settings, or even lock out legitimate users. With full access to administrative privileges, they could wreak havoc or steal valuable information.
Think of this vulnerability as a party where anyone can stroll in just by knowing the name on the guest list. If they know a valid username, they're in — no invitation needed! This vulnerability arises from missing identity validation in the social login function `social_login_using_email()` in the RegistrationMagic plugin for WordPress. Versions 5.0.1.7 and below are affected, allowing unauthenticated users to bypass login checks.
This is absolutely devastating! An attacker could waltz right in, access sensitive data, change settings, or even lock out legitimate users. With full access to administrative privileges, they could wreak havoc or steal valuable information. To patch this vulnerability, update the RegistrationMagic plugin to version 5.0.1.8 or later immediately. Additionally, review user accounts and privilege assignments to ensure no unauthorized access has occurred. Enable strong login security measures like two-factor authentication where possible. You've got this! With a quick update and a little vigilance, you can keep your site safe and sound! 🛡️