CVE-2017-20208
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary PHP code on WordPress sites using vulnerable versions of the RegistrationMagic plugin. Attackers can inject malicious PHP objects through deserialization, potentially leading to remote file inclusion and complete site compromise. All WordPress sites using RegistrationMagic plugin versions below 3.7.9.3 are affected.
💻 Affected Systems
- RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover, data theft, malware installation, and server compromise leading to lateral movement within the hosting environment.
Likely Case
Remote code execution leading to website defacement, backdoor installation, credential theft, and data exfiltration.
If Mitigated
Limited impact if proper web application firewalls and input validation are in place, though exploitation may still succeed.
🎯 Exploit Status
Exploited in the wild as a zero-day. Attack requires no authentication and minimal technical skill due to available exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.9.3 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/1733274/custom-registration-form-builder-with-submission-manager
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find RegistrationMagic plugin. 4. Click 'Update Now' if available. 5. If no update appears, manually download version 3.7.9.3+ from WordPress.org and replace plugin files.
🔧 Temporary Workarounds
Disable RegistrationMagic Plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate custom-registration-form-builder-with-submission-manager
Web Application Firewall Rule
allBlock requests containing serialized PHP object patterns
# Add WAF rule to block requests with 'O:' followed by numbers (PHP serialized objects)
🧯 If You Can't Patch
- Immediately disable or remove the RegistrationMagic plugin from all WordPress installations
- Implement strict input validation and sanitization for all user-supplied data in the is_expired_by_date() function
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins → RegistrationMagic version. If version is below 3.7.9.3, system is vulnerable.Check Version:
wp plugin get custom-registration-form-builder-with-submission-manager --field=versionVerify Fix Applied:
Verify RegistrationMagic plugin version is 3.7.9.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to WordPress endpoints containing serialized PHP objects
- Unexpected file writes in wp-content/uploads or plugin directories
- Suspicious PHP execution patterns
Network Indicators:
- HTTP requests with serialized data patterns (O: followed by numbers)
- Outbound connections to unknown servers from WordPress process
SIEM Query:
source="wordpress.log" AND ("O:" AND "is_expired_by_date" OR "RegistrationMagic")🔗 References
- https://plugins.trac.wordpress.org/changeset/1733274/custom-registration-form-builder-with-submission-manager
- https://www.wordfence.com/blog/2017/10/3-zero-day-plugin-vulnerabilities-exploited-wild/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b79193-f8fc-4ea2-8973-fe292cfb926b?source=cve
