CVE-2026-15257
Received Received - Intake

Authorization Bypass in RegistrationMagic WordPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: WPScan

Description
The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-15257
EUVD
EUVD-2026-51000

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
registrationmagic registrationmagic to 6.0.9.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the RegistrationMagic WordPress plugin versions before 6.0.9.4. It allows unauthenticated attackers to modify form submissions and user profile fields of non-administrator accounts due to missing authorization checks. The flaw enables overwriting existing data by exploiting an insecure direct object reference (IDOR) vulnerability.

Detection Guidance

Check if the RegistrationMagic plugin version is below 6.0.9.4 by inspecting the plugin files or WordPress admin panel. Look for unauthorized modifications to form submissions or user profile fields in the database or logs.

Impact Analysis

Unauthenticated attackers could alter your form submissions or profile fields if you use a vulnerable version of RegistrationMagic. This could lead to data corruption, unauthorized changes to user information, or misuse of submitted data. Administrator accounts are not affected.

Compliance Impact

This vulnerability could compromise data integrity and confidentiality, potentially violating GDPR (data protection) and HIPAA (health data privacy) requirements. Unauthorized modifications to user data may lead to non-compliance with these regulations.

Mitigation Strategies

Update the RegistrationMagic plugin to version 6.0.9.4 or later immediately. Disable front-end submission editing if not required. Review and remove any unauthorized changes to form submissions or user profiles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart