Deserialization in Metagauss Registrationmagic
CVE-2017-20208
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to fetch a remote file and install it on the site.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (52.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 52.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/c2b79193-f8fc-4ea2-8973-fe292… (Technical Description)
- www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/ (Third Party Advisory, Press/Media Coverage)
- plugins.trac.wordpress.org/changeset/1733274/custom-registration-form-builder-w… (Patch)
Frequently asked questions
- What is CVE-2017-20208?
- CVE-2017-20208 is a critical-severity vulnerability in Metagauss Registrationmagic, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-10-18.
- How severe is CVE-2017-20208?
- Critical severity. CVSS v3 base score is 9.8 out of 10.