What is the CVSS score of CVE-2026-32498?

CVE-2026-32498 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Registrationmagic are affected by CVE-2026-32498?

CVE-2026-32498 presents notable security risk, a missing authorization vulnerability rated CVSS 7.5.

How to fix or mitigate CVE-2026-32498?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Registrationmagic CVE-2026-32498

EUVD-2026-15845 HIGH

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-gx65-44f7-jh3q

Authentication Bypass Registrationmagic

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15845

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.

AnalysisAI

A missing authorization vulnerability exists in Metagauss RegistrationMagic (custom-registration-form-builder-with-submission-manager) plugin versions up to and including 6.0.7.6, where incorrectly configured access control allows attackers to bypass authentication mechanisms and exploit broken access control. An attacker can leverage this vulnerability to perform unauthorized actions within the application by circumventing intended authorization checks. The vulnerability is classified as CWE-862 (Missing Authorization) and was reported by Patchstack; while CVSS and EPSS scores are not publicly available, the authentication bypass nature of this flaw indicates significant exploitability potential.

Technical ContextAI

The vulnerability resides in the RegistrationMagic WordPress plugin (CPE: cpe:2.3:a:metagauss:registrationmagic), a custom registration form builder with submission management functionality. The root cause is classified under CWE-862 (Missing Authorization), which describes a failure to enforce authorization checks at critical decision points within the application. In the context of WordPress plugins, this typically manifests as missing or inadequate nonce verification, capability checks, or access control logic on admin/sensitive AJAX endpoints or form submission handlers. The plugin's form submission and management features lack proper authorization enforcement, allowing unauthenticated or low-privilege users to interact with protected functionality that should be restricted based on user roles and permissions.

RemediationAI

Users of RegistrationMagic should immediately upgrade to a version newer than 6.0.7.6, as a patched release has been made available by Metagauss to address this authorization bypass. Consult the plugin's official release notes and Patchstack advisory for the exact patched version number. Until patching is possible, administrators should implement network-level access restrictions to limit exposure of the WordPress admin interface and form submission endpoints to trusted IP ranges, disable the RegistrationMagic plugin if it is not actively in use, and review user roles and capabilities to ensure only authorized administrators have access to form management features. Additionally, enable WordPress security hardening practices such as two-factor authentication for admin accounts and utilize Web Application Firewall (WAF) rules to detect and block suspicious authorization attempts targeting form submission endpoints.