CVE-2026-24373
Incorrect Privilege Assignment in RegistrationMagic Allows Escalation
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| metagauss | registrationmagic | to 6.0.7.1 (inc) |
| registrationmagic | custom_registration_form_builder_with_submission_manager | to 6.0.7.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2026-24373, users should immediately update the RegistrationMagic WordPress plugin to version 6.0.7.2 or later, which contains the fix for this vulnerability.
Until the update can be applied, Patchstack has issued a mitigation rule that can block attacks targeting this vulnerability.
Patchstack also offers automatic mitigation and auto-update features for vulnerable plugins to ensure rapid protection.
Can you explain this vulnerability to me?
CVE-2026-24373 is a high-priority Broken Authentication vulnerability found in the WordPress RegistrationMagic plugin versions up to and including 6.0.7.1.
This vulnerability allows unauthenticated attackers to perform actions that are normally restricted to users with higher privileges, potentially enabling them to gain administrative access to affected websites.
It is classified under the OWASP Top 10 category A7: Identification and Authentication Failures, indicating a serious flaw in how authentication and privilege assignment are handled.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows attackers to escalate their privileges without authentication.
An attacker exploiting this flaw can gain administrative access to your website, which could lead to unauthorized control over site content, user data, and configuration.
Such unauthorized access can result in data breaches, defacement, or use of the site for malicious purposes.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific detection methods or commands to identify the presence of CVE-2026-24373 on your network or system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-24373 vulnerability allows unauthenticated attackers to gain administrative access to affected websites by exploiting broken authentication in the RegistrationMagic WordPress plugin. This unauthorized access can lead to potential data breaches or unauthorized data manipulation.
Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive personal and health information to protect user privacy and data security.
Therefore, if exploited, this vulnerability could result in violations of these regulations due to failure to adequately protect user data and maintain proper access controls.