Critical · published May 16, 2023
🚨 An authentication bypass in the RegistrationMagic plugin allows attackers to log in as any user, including administrators, just by knowing the email! 🔥 Think of it like a party where the bouncer doesn't check IDs at the door; anyone can walk in claiming to be someone else, even the VIP! This vulnerability could lead to attackers accessing sensitive site data, changing settings, or even locking out admins. It’s like handing over the keys to your castle and inviting trouble in!
Think of it like a party where the bouncer doesn't check IDs at the door; anyone can walk in claiming to be someone else, even the VIP! The RegistrationMagic plugin fails to properly verify users during Google social logins, enabling unauthenticated attackers to log in as existing users if they have access to the associated email.
This vulnerability could lead to attackers accessing sensitive site data, changing settings, or even locking out admins. It’s like handing over the keys to your castle and inviting trouble in! Update the RegistrationMagic plugin to version 5.2.2 or later immediately. Review user access and change any passwords for critical accounts, especially admin accounts. 🛡️ You've got this! Follow these steps and you'll have your site secure in no time! 💪✨