CVE-2024-1991 Overview
CVE-2024-1991 is a privilege escalation vulnerability in the RegistrationMagic WordPress plugin developed by Metagauss. The plugin, marketed as Custom Registration Forms, User Registration, Payment, and User Login, contains a missing capability check on the update_users_role() function. All versions up to and including 5.3.0.0 are affected. Authenticated attackers holding subscriber-level access or higher can call the vulnerable function to elevate their account to administrator. The flaw is tracked under CWE-862: Missing Authorization.
Critical Impact
Any authenticated subscriber can escalate to administrator, granting full control over the WordPress site including content, users, and installed plugins.
Affected Products
- Metagauss RegistrationMagic plugin for WordPress, all versions through 5.3.0.0
- WordPress sites running the custom-registration-form-builder-with-submission-manager plugin slug
- Sites permitting open user registration where subscriber accounts are auto-provisioned
Discovery Timeline
- 2024-04-09 - CVE-2024-1991 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1991
Vulnerability Analysis
The vulnerability resides in the update_users_role() function within services/class_rm_user_services.php of the RegistrationMagic plugin. The function modifies WordPress user role assignments but does not verify that the caller has authorization to change user roles. WordPress's role system relies on capability checks such as current_user_can('promote_users') to gate administrative role changes. The affected function omits this check, allowing any authenticated user session to invoke the role-change logic. A subscriber can therefore assign themselves the administrator role and gain full backend access. Once elevated, the attacker can install malicious plugins, modify themes, exfiltrate user data, or plant persistent web shells. Wordfence's threat intelligence entry documents the technical behavior and remediated changeset.
Root Cause
The root cause is missing authorization enforcement [CWE-862]. The update_users_role() handler processes role-update requests without validating the current user's capabilities. WordPress does not perform this check automatically; individual plugin handlers must call current_user_can() before privileged actions. The vendor added the required capability check in changeset 3049490.
Attack Vector
Exploitation requires only a valid low-privilege account. On sites with open registration, an attacker registers a subscriber account, authenticates, and sends a crafted request to the plugin endpoint that invokes update_users_role() with the attacker's user ID and a target role of administrator. No user interaction is required from a site operator. The attack is network-reachable over standard HTTP or HTTPS. See the vulnerable source line for the specific handler.
Detection Methods for CVE-2024-1991
Indicators of Compromise
- Unexpected changes to the wp_usermeta table where meta_key = 'wp_capabilities' shifts a low-privilege account to administrator.
- New administrator accounts appearing in wp_users shortly after subscriber registrations.
- HTTP requests to RegistrationMagic AJAX or admin-post endpoints originating from non-admin sessions.
- WordPress audit log entries showing role changes performed by users lacking promote_users capability.
Detection Strategies
- Query the WordPress database periodically for role escalations and correlate with the acting user's prior capability level.
- Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated or subscriber-level POST requests targeting RegistrationMagic role-update actions.
- Compare the installed plugin version against 5.3.0.0 and flag hosts running vulnerable builds.
- Enable a WordPress audit-logging plugin to record every role change with source IP and user context.
Monitoring Recommendations
- Forward WordPress access logs and PHP error logs to a centralized log platform for retention and correlation.
- Alert on any addition of the administrator role to accounts created within the last 30 days.
- Monitor for post-exploitation behaviors such as new plugin installations, theme file modifications, or wp-config.php writes.
- Track outbound connections from the web server to unfamiliar hosts, which may indicate a planted web shell.
How to Mitigate CVE-2024-1991
Immediate Actions Required
- Update the RegistrationMagic plugin to a version above 5.3.0.0 that includes changeset 3049490.
- Audit all WordPress accounts and remove any unauthorized administrator users.
- Rotate credentials for all remaining administrator accounts and enforce multi-factor authentication.
- Review installed plugins, themes, and uploaded files for signs of post-exploitation persistence.
Patch Information
The vendor addressed the vulnerability by adding a capability check to the update_users_role() function. The fix is committed in WordPress plugin changeset 3049490. Site administrators should install the latest release from the WordPress.org plugin repository. Automatic plugin updates should be enabled where operationally feasible.
Workarounds
- Disable and remove the RegistrationMagic plugin until the update can be applied.
- Disable open user registration by unchecking Settings → General → Anyone can register in the WordPress admin.
- Apply a WAF rule that blocks requests to RegistrationMagic role-management actions from non-administrator sessions.
- Restrict access to /wp-admin/admin-ajax.php handlers exposed by the plugin using server-level access controls.
# Configuration example: WP-CLI commands to audit accounts and update the plugin
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp plugin update custom-registration-form-builder-with-submission-manager
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
