EUVD-2026-51000
GHSA-vgp8-mh5v-wf9p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible endpoint, no credentials or nonce required; impact limited to low integrity on non-admin user data only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.
AnalysisAI
RegistrationMagic WordPress plugin versions prior to 6.0.9.4 allows unauthenticated remote attackers to overwrite other users' front-end form submissions and the WordPress profile fields of the associated non-administrator accounts by exploiting absent authorization, ownership, and nonce validation on a submission-editing action. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default plugin deployment. A public proof-of-concept exists per WPScan, though EPSS sits at 0.14% (4th percentile) and this CVE is not in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.
Technical ContextAI
RegistrationMagic is a WordPress plugin providing custom user registration forms, submission management, and profile field handling. The vulnerability is rooted in a missing authorization control class (analogous to CWE-862: Missing Authorization) on a front-end AJAX or POST submission-editing handler. WordPress nonces are cryptographic tokens that bind requests to a session and action, preventing cross-site request forgery; their complete absence here means any external HTTP request can invoke the action. The lack of an ownership check means the plugin does not verify that the requesting party is the original submitter, enabling enumeration or guessing of submission identifiers to target arbitrary non-admin users. The affected product identifier per CPE is cpe:2.3:a:unknown:registrationmagic:*:*:*:*:*:*:*:*, spanning all versions before 6.0.9.4. Notably, CWE is listed as N/A in the source data, which is likely a metadata gap - the described flaw clearly maps to missing authorization and missing CSRF token validation.
RemediationAI
Upgrade RegistrationMagic to version 6.0.9.4 or later, which is the vendor-confirmed patched release closing the missing authorization, ownership, and nonce checks. The WPScan advisory at https://wpscan.com/vulnerability/fe6d0f6a-c2b4-4cd1-a7d2-e3afec76ebca/ documents the fix. If an immediate upgrade is not feasible, administrators should evaluate whether the plugin's front-end submission-editing feature can be disabled via plugin settings, which removes the exposed endpoint at the cost of preventing legitimate users from amending their own submissions. Alternatively, a web application firewall rule can be configured to block unauthenticated POST requests targeting the specific RegistrationMagic action hooks responsible for submission editing - this preserves authenticated editing while blocking unauthenticated abuse, though WAF rule specificity will depend on endpoint structure discoverable from the proof-of-concept.
More in Registrationmagic
View allRegistrationMagic WordPress plugin before version 6.0.9.9 omits audience validation on Facebook OAuth access tokens duri
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (wi
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) t
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (wi
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requ
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. Rated high severity (CVSS 8.1), this vuln
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name paramet
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attac
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today