What is the CVSS score of CVE-2026-49764?

CVE-2026-49764 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of RegistrationMagic are affected by CVE-2026-49764?

RegistrationMagic WordPress plugin versions 6.0.8.6 and earlier contain a critical authentication bypass vulnerability (CVE-2026-49764) that allows unauthenticated attackers to access protected…

How to fix or mitigate CVE-2026-49764?

Within 24 hours: Audit all WordPress instances to identify those running RegistrationMagic version 6.0.8.6 or earlier; disable the plugin immediately or restrict access to registration endpoints. Within 7 days: Deploy Web Application Firewall rules to block authentication bypass exploitation attempts; audit user accounts for unauthorized access or modifications; subscribe to vendor notifications for patch availability. Within 30 days: Replace RegistrationMagic with an alternative registration solution, or upgrade to a patched version once released by the vendor.

RegistrationMagic CVE-2026-49764

EUVD-2026-36888 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-15 Patchstack

GHSA-2hf6-3gj9-p8hw

Information Disclosure Registrationmagic

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

WordPress plugin endpoint is network-reachable (AV:N), CWE-288 implies low-complexity bypass (AC:L), no auth needed (PR:N/UI:N), and broken auth typically yields full data and account control (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:31 vuln.today

DescriptionCVE.org

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.

AnalysisAI

Authentication bypass in the RegistrationMagic WordPress plugin (versions up to and including 6.0.8.6) allows unauthenticated remote attackers to circumvent intended authentication controls and gain access to protected resources. The flaw, tracked as CWE-288 and reported by Patchstack, carries a critical 9.8 CVSS score because exploitation requires no privileges, no user interaction, and is reachable over the network. There is no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

RegistrationMagic (developed by Metagauss, slug 'custom-registration-form-builder-with-submission-manager') is a WordPress plugin used to build custom user registration forms and manage submissions on WordPress sites. The CWE-288 classification - Authentication Bypass Using an Alternate Path or Channel - indicates that an attacker can reach a protected endpoint or function without traversing the plugin's normal authentication flow, typically because a route, AJAX handler, REST endpoint, or capability check is missing or improperly enforced. The CPE 'cpe:2.3:a:metagauss:registrationmagic' confirms all builds of the plugin at or below 6.0.8.6 are within scope.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-8-6-broken-authentication-vulnerability) and the WordPress plugin repository for any release above 6.0.8.6 and upgrade immediately when available. Until a fix ships, deactivate the RegistrationMagic plugin on production sites (trade-off: registration forms break and any shortcodes embedded in pages will render empty), or place the WordPress site behind a WAF such as Patchstack/Wordfence with a virtual patch rule for this CVE (trade-off: depends on signature accuracy and does not protect direct admin-ajax.php or REST routes if rules are bypassed), and restrict access to /wp-admin/admin-ajax.php and /wp-json/ paths exposed by the plugin to authenticated IPs where feasible (trade-off: may break front-end registration for legitimate users).