EUVD-2026-50999
GHSA-vm2x-vwh2-372v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible with no auth required; confidentiality limited to form PII only; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
AnalysisAI
Unauthorized access to other users' form submission data is possible in RegistrationMagic WordPress plugin versions prior to 6.0.9.4 due to missing OTP-to-identity binding validation. The plugin accepts a one-time password from a cookie without confirming it corresponds to the identity being requested, enabling unauthenticated network-based retrieval of personal information submitted through front-end registration forms. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target WordPress site to have the RegistrationMagic plugin (version below 6.0.9.4) installed and active, with the front-end form submission retrieval feature in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 5.3 (Medium) reflects a network-accessible, zero-prerequisite attack path with limited confidentiality impact - consistent with the unauthenticated IDOR pattern described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running RegistrationMagic before 6.0.9.4 and obtains or enumerates a valid OTP cookie value - potentially from an intercepted session, a predictable value, or by triggering their own registration flow to observe the OTP format. They then replay that OTP cookie in a request scoped to a different user's identity, and the plugin returns the victim's form submission data without enforcing an OTP-to-identity check. … |
| Remediation | Update the RegistrationMagic WordPress plugin to version 6.0.9.4 or later, which contains the vendor-released patch confirmed by WPScan at https://wpscan.com/vulnerability/21fa84b9-afa6-49f7-abb1-c1edabda3cd8/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Registrationmagic
View allIn the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (wi
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) t
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (wi
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requ
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. Rated high severity (CVSS 8.1), this vuln
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name paramet
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attac
Authentication bypass in the RegistrationMagic WordPress plugin (versions up to and including 6.0.8.6) allows unauthenti
The RegistrationMagic - User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to pr
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today