RegistrationMagic OTP cookies expose other users' submissions
RegistrationMagic before 6.0.9.4 validates the rm_secure_otp cookie against a front-user record but obtains the authorized identity separately from the attacker-controlled rm_autorized_email cookie. A visitor with a valid RegistrationMagic OTP session for one email can replace the email cookie with another identity, then request the configured front-end submissions page and select a submission_id; RM_Front_Controller::submissions() treats that cookie value as the authorized email and returns the matching user's submission details, including personal information. No WordPress account is required. Version 6.0.9.4 resolves the email from the database row bound to the OTP instead of trusting the separate email cookie.
- Component
- RegistrationMagic
- Plugin slug
registrationmagic- Affected
- < 6.0.9.4
- Safe version
6.0.9.4- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 18 known issues for this plugin.
Update, patch or deactivate.
Update RegistrationMagic to 6.0.9.4 or later. Expire existing RegistrationMagic front-end OTP sessions and review access logs for unusual requests to the front-end submissions page or enumeration of submission_id values. Treat exposed submission fields according to the site's privacy and incident-response requirements.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N