EUVD-2026-51000
GHSA-vgp8-mh5v-wf9p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible endpoint, no credentials or nonce required; impact limited to low integrity on non-admin user data only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.
AnalysisAI
RegistrationMagic WordPress plugin versions prior to 6.0.9.4 allows unauthenticated remote attackers to overwrite other users' front-end form submissions and the WordPress profile fields of the associated non-administrator accounts by exploiting absent authorization, ownership, and nonce validation on a submission-editing action. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials and no user interaction against any default plugin deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a WordPress installation with the RegistrationMagic plugin installed and active in any version prior to 6.0.9.4. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS Medium score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects that while exploitation is trivially accessible from the network with zero prerequisites, the concrete impact is constrained to integrity corruption of non-administrator user data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running RegistrationMagic prior to 6.0.9.4 and, using the publicly available WPScan proof-of-concept, sends a crafted HTTP POST request to the plugin's front-end submission-editing endpoint while specifying a victim non-administrator user's submission ID. The server processes the request without validating a nonce, verifying the caller's identity, or confirming ownership of the submission, and overwrites the victim's stored form data and WordPress profile fields with attacker-controlled values. |
| Remediation | Upgrade RegistrationMagic to version 6.0.9.4 or later, which is the vendor-confirmed patched release closing the missing authorization, ownership, and nonce checks. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Registrationmagic
View allIn the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (wi
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) t
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (wi
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requ
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. Rated high severity (CVSS 8.1), this vuln
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name paramet
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attac
Authentication bypass in the RegistrationMagic WordPress plugin (versions up to and including 6.0.8.6) allows unauthenti
The RegistrationMagic - User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to pr
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today