CVE-2024-1990 Overview
CVE-2024-1990 is a blind SQL injection vulnerability in the RegistrationMagic WordPress plugin by Metagauss. The flaw affects all versions up to and including 5.3.1.0 and resides in the id parameter of the RM_Form shortcode. Insufficient escaping of user-supplied input and lack of prepared statements in the underlying SQL query allow authenticated attackers with contributor-level access or above to append additional SQL clauses. Successful exploitation lets attackers extract sensitive data from the WordPress database, including credential hashes and configuration secrets. The vulnerability is tracked under [CWE-89: SQL Injection].
Critical Impact
Authenticated contributors can exfiltrate arbitrary data from the WordPress database through blind SQL injection in the RM_Form shortcode id parameter.
Affected Products
- Metagauss RegistrationMagic plugin for WordPress, all versions up to and including 5.3.1.0
- WordPress sites using the plugin's RM_Form shortcode
- Deployments allowing contributor-level or higher user registration
Discovery Timeline
- 2024-04-09 - CVE-2024-1990 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1990
Vulnerability Analysis
The vulnerability lives in the public-facing shortcode handler class_rm_public.php, which processes the RM_Form shortcode. When rendering a form, the handler reads the id attribute supplied by the shortcode caller and inserts it directly into a SQL query. Because the value is neither escaped with esc_sql() nor bound through $wpdb->prepare(), an attacker can inject additional SQL syntax into the executing statement.
Because the query does not return injected values in the HTTP response, exploitation relies on blind techniques. Attackers use boolean-based or time-based payloads to infer data one bit at a time. WordPress database contents, including the wp_users table with password hashes and secret keys in wp_options, become reachable through repeated inference queries.
Root Cause
The root cause is missing parameterization of a dynamically constructed SQL query. The id parameter flows from the shortcode attribute array into a database call without sanitization. The upstream fix, visible in WordPress Plugin Changeset 3049490 and Changeset 3057216, introduces proper preparation of the query and casts the input to an integer before it reaches the database layer.
Attack Vector
Exploitation requires an authenticated user account with at least contributor-level permissions on the target WordPress site. The attacker creates or edits a post that embeds the RM_Form shortcode and supplies a crafted id attribute containing SQL syntax. When WordPress renders the post, the plugin executes the tainted query on behalf of the site. See the Wordfence Vulnerability Analysis for additional context.
// No verified public exploit code is available.
// The vulnerability is triggered by supplying SQL syntax
// in the `id` attribute of the [RM_Form id="..."] shortcode
// when embedded in a post or page by an authenticated contributor.
Detection Methods for CVE-2024-1990
Indicators of Compromise
- Posts, pages, or custom post types authored by contributor-level accounts that embed the RM_Form shortcode with non-numeric id values.
- WordPress access logs showing repeated requests to posts containing the shortcode with slight response-size or response-time variations, consistent with blind injection inference.
- Unexpected outbound queries against wp_users, wp_usermeta, or wp_options originating from the plugin's runtime path.
Detection Strategies
- Inspect wp_posts content for [RM_Form ...] shortcodes containing SQL keywords such as UNION, SLEEP, BENCHMARK, SELECT, or OR 1=1.
- Enable database query logging on staging environments and compare executing statements against the plugin source to identify unparameterized queries.
- Deploy a web application firewall ruleset that flags SQL metacharacters inside shortcode attributes on WordPress endpoints.
Monitoring Recommendations
- Alert on contributor and author accounts publishing or previewing posts that reference the RM_Form shortcode.
- Track response-time anomalies on WordPress URLs that render pages containing RegistrationMagic forms.
- Monitor for new low-privilege user registrations followed shortly by post creation activity, a common precursor to authenticated injection attempts.
How to Mitigate CVE-2024-1990
Immediate Actions Required
- Upgrade the RegistrationMagic plugin to a version later than 5.3.1.0 that includes the fixes in changesets 3049490 and 3057216.
- Audit contributor, author, and editor accounts and remove or disable any accounts that are unused or unrecognized.
- Rotate WordPress secret keys and salts in wp-config.php and force password resets if compromise is suspected.
Patch Information
Metagauss addressed the vulnerability in the plugin trunk via Changeset 3049490 and Changeset 3057216. The patches cast the id shortcode attribute to an integer and route the query through $wpdb->prepare() to eliminate the injection sink. Site owners should install the patched release from the WordPress plugin repository.
Workarounds
- Restrict the unfiltered_html and post publishing capabilities for contributor-level users until the plugin is patched.
- Temporarily deactivate the RegistrationMagic plugin if patching cannot be completed immediately.
- Deploy a WAF rule that blocks non-integer values in the id attribute of the RM_Form shortcode on POST and preview requests.
# Update the plugin via WP-CLI on the affected WordPress host
wp plugin update custom-registration-form-builder-with-submission-manager
# Verify the installed version is above 5.3.1.0
wp plugin get custom-registration-form-builder-with-submission-manager --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
