CVE-2026-15255 — RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before r…
Published: 2026-07-30 · CVSS: 5.3 · CVSS 3.1
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7