CVE-2020-9456: 
WordPress vulnerability analysis and mitigation

In the RegistrationMagic WordPress plugin through version 4.6.0.3, a privilege escalation vulnerability was discovered that allows remote authenticated users with minimal privileges to elevate their access to administrator level. The vulnerability exists in the user controller component, specifically in the class_rm_user_controller.php rm_user_edit functionality (MITRE CVE, Wordfence Blog).

The vulnerability received a CVSS score of 9.9 (Critical) with the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The issue was found in the user controller component where insufficient access controls in the rm_user_edit functionality allowed authenticated users with minimal privileges to modify their account permissions (Wordfence Blog).

The vulnerability allows attackers with subscriber-level permissions to elevate their account privileges to administrator level, potentially gaining full control over the WordPress site. Additionally, attackers could export all forms on the site, including historical submission data (WPScan).

The vulnerability was patched in version 4.6.0.4 of the RegistrationMagic plugin. Site administrators should update to this version or later to protect against this security issue (WPScan).