Deserialization in Metagauss Registrationmagic
CVE-2017-20208
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
Vulnerability class: Insecure Deserialization
EPSS: 0.007 (49.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
Weakness classification (CWE)
References
- security@wordfence.com (Technical Description)
- security@wordfence.com (Third Party Advisory, Press/Media Coverage)
- security@wordfence.com (Patch)
Frequently asked questions
- What is CVE-2017-20208?
- CVE-2017-20208 is a critical-severity vulnerability in Metagauss Registrationmagic, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-10-18.
- How severe is CVE-2017-20208?
- Critical severity. CVSS v3 base score is 9.8 out of 10.