CVE-2026-15257 — RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification

CVE-2026-15257

RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification PUBLISHED

Description (CNA)

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.

Affected (CNA)

Vendor / product	Versions
Unknown / RegistrationMagic	affected 0 before 6.0.9.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/fe6d0f6a-c2b4-4cd1-a7d2-e3afec76ebca/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.