What is the CVSS score of CVE-2026-24373?

CVE-2026-24373 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Registrationmagic are affected by CVE-2026-24373?

CVE-2026-24373 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-24373?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Registrationmagic CVE-2026-24373

EUVD-2026-15569 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-03-25 Patchstack

Privilege Escalation Registrationmagic

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15569

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Incorrect Privilege Assignment vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Privilege Escalation.This issue affects RegistrationMagic: from n/a through <= 6.0.7.1.

AnalysisAI

RegistrationMagic, a WordPress plugin for custom registration forms, contains an Incorrect Privilege Assignment vulnerability (CWE-266) that allows privilege escalation through improper access controls. Versions up to and including 6.0.7.1 are affected, enabling attackers to escalate privileges and potentially take over user accounts. While CVSS and EPSS scores are not publicly available, the vulnerability has been documented by Patchstack and assigned ENISA tracking ID EUVD-2026-15569, indicating active vulnerability research and disclosure.

Technical ContextAI

The vulnerability stems from CWE-266 (Incorrect Privilege Assignment), a weakness in how the RegistrationMagic plugin (cpe:2.3:a:metagauss:registrationmagic) assigns or validates user permissions and roles within the WordPress plugin architecture. WordPress plugins that handle user registration and form submission are particularly sensitive to privilege assignment flaws because they often interact directly with WordPress capability systems and user role management. The underlying issue appears to be insufficient validation of user privileges during registration form processing or submission handling, allowing a lower-privileged user to execute actions reserved for higher-privilege accounts (such as administrators). This class of vulnerability is common in plugins that manage custom registration workflows but fail to properly enforce WordPress nonces, capability checks, or role-based access control (RBAC) on administrative or privileged operations.

RemediationAI

Immediately upgrade RegistrationMagic to a version newer than 6.0.7.1 once available from the vendor; consult the Patchstack database link for patch release information and verify vendor advisory before upgrading. If an updated version is not yet available, disable the RegistrationMagic plugin entirely until patching is possible, reverting to WordPress's native registration system or an alternative plugin with a confirmed patch. As interim mitigations, implement strict WordPress user role management to limit the number of accounts with administrative capabilities, enforce WordPress nonces and capability checks on all custom forms via a security hardening plugin, restrict backend access to trusted IP ranges, and enable comprehensive audit logging to detect privilege escalation attempts. Consider engaging a WordPress security specialist to perform a code review of the plugin's user privilege handling if the plugin is mission-critical and cannot be disabled.