EUVD-2026-50999
GHSA-vm2x-vwh2-372v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible with no auth required; confidentiality limited to form PII only; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
AnalysisAI
Unauthorized access to other users' form submission data is possible in RegistrationMagic WordPress plugin versions prior to 6.0.9.4 due to missing OTP-to-identity binding validation. The plugin accepts a one-time password from a cookie without confirming it corresponds to the identity being requested, enabling unauthenticated network-based retrieval of personal information submitted through front-end registration forms. A publicly available exploit exists per WPScan, though EPSS at 0.14% (4th percentile) and the absence of a CISA KEV listing indicate exploitation has not been observed at scale.
Technical ContextAI
RegistrationMagic is a WordPress plugin providing custom user registration and form management functionality. The vulnerability stems from a failure to bind one-time password (OTP) tokens - stored in browser cookies - to the specific user identity they were issued for before serving form submission results. This is structurally an Insecure Direct Object Reference (IDOR) or authorization bypass flaw, analogous to CWE-639 (Authorization Bypass Through User-Controlled Key), though no CWE has been formally assigned per NVD. The plugin's session validation logic trusts the cookie OTP as sufficient proof of identity for data retrieval without verifying the OTP-to-user mapping server-side. Affected CPE: cpe:2.3:a:unknown:registrationmagic:*:*:*:*:*:*:*:* covering all versions before 6.0.9.4.
RemediationAI
Update the RegistrationMagic WordPress plugin to version 6.0.9.4 or later, which contains the vendor-released patch confirmed by WPScan at https://wpscan.com/vulnerability/21fa84b9-afa6-49f7-abb1-c1edabda3cd8/. WordPress site administrators can update directly from the Plugins dashboard or via WP-CLI with 'wp plugin update registrationmagic'. If immediate patching is not feasible, a compensating control is to temporarily disable any front-end form submission retrieval features within RegistrationMagic's settings, which prevents exposure of stored submission data - though this trades off user-facing functionality. A WAF rule blocking requests that present OTP cookie values with mismatched session identifiers may reduce exploitation surface but requires knowledge of the specific cookie parameter names. Disabling the plugin entirely stops exploitation but halts all registration workflows.
More in Registrationmagic
View allRegistrationMagic WordPress plugin before version 6.0.9.9 omits audience validation on Facebook OAuth access tokens duri
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (wi
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) t
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (wi
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requ
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. Rated high severity (CVSS 8.1), this vuln
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name paramet
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attac
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today