CVE-2026-15257 — RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification
The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticat…
Published: 2026-07-30 · CVSS: 5.3 · CVSS 3.1
The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7