CVE-2024-1991

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-19936.4The Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and i CVE-2024-19944.3The Image Watermark plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the waterma CVE-2024-19954.3The Smart Custom Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relationa CVE-2024-19965.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's IHover widget link in all versions CVE-2024-19975.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premium_fbchat_app_id' parameter of the Me CVE-2024-19995.4The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tes CVE-2024-20005.4The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'navigation_dots' parameter of the Multi Sc CVE-2024-200016.7In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with Syste CVE-2024-200026.7In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with Syste CVE-2024-200037.5In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent CVE-2024-200047.5In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent CVE-2024-200058.2In da, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System