CVE-2020-9454

CVE-2020-9454 describes a Cross-Site Request Forgery (CSRF) vulnerability in the RegistrationMagic WordPress plugin, affecting versions through 4.6.0.3. This flaw allows unauthenticated remote attackers to trick a logged-in administrator into executing malicious requests. The vulnerability carries a high CVSS score of 8.8, indicating a critical impact where an attacker could fully compromise plugin settings, including deleting users, creating privileged roles, and enabling PHP file uploads. While the vulnerability is severe, there is no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules, and it has received minimal community discussion or media coverage.