CVE-2026-15255
Deferred Deferred - Pending Action

RegistrationMagic WordPress Plugin Information Disclosure Vulnerability

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: WPScan

Description
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-15255
EUVD
EUVD-2026-50999

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
registrationmagic registrationmagic to 6.0.9.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the RegistrationMagic WordPress plugin versions before 6.0.9.4. It allows unauthenticated attackers to access other users' form submission data, including sensitive personal information, by exploiting improper validation of a one-time password (OTP) in a cookie. The plugin fails to ensure the OTP belongs to the requested user before displaying form submissions.

Detection Guidance

Check if your RegistrationMagic plugin version is below 6.0.9.4. Inspect network traffic for unauthorized access to form submissions by monitoring cookies containing one-time passwords and submission ID parameters. Look for unusual requests to endpoints handling form data.

Impact Analysis

If you use a vulnerable version of the RegistrationMagic plugin, an attacker could access your form submissions without authorization. This may expose personal information you submitted through forms, such as contact details, sensitive data, or other private content. The impact includes potential privacy breaches and unauthorized data access.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA. It may result in unauthorized access to personal data, violating principles of data minimization, purpose limitation, and security. Organizations could face legal penalties, reputational damage, and loss of trust due to compromised user data.

Mitigation Strategies

Update the RegistrationMagic plugin to version 6.0.9.4 or later immediately. Review and restrict access to form submission endpoints. Monitor for unauthorized access attempts and audit user permissions to ensure proper authorization checks are in place.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15255. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart