Executive brief
RegistrationMagic is a WordPress plugin used to create custom registration forms and manage user submissions. A security flaw allows unauthenticated individuals to modify other users' form submissions and change the profile information (such as names) of non-administrator accounts. This could lead to unauthorized data modification and disruption of user profile integrity on the website.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) within the front-end submission-editing functionality of the RegistrationMagic plugin. Specifically, the plugin does not validate the ownership or authorization of a user attempting to edit a submission via the 'rm_user_form_edit_sub' action, nor does it use nonces to prevent CSRF or unauthorized requests. An unauthenticated attacker can send a crafted POST request to the site's submission page, targeting a specific 'submission_id'. If the submission is linked to a non-administrator WordPress account via an email address, the attacker can overwrite both the form data and the associated WordPress user's profile fields (first name, last name, and display name). This issue is resolved in version 6.0.9.4.
Affected products
- Metagauss RegistrationMagic < 6.0.9.4
Timeline
- 2026-07-10: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD published the CVE record