RegistrationMagic lets visitors overwrite other users' submissions
RegistrationMagic before 6.0.9.4 routes a public request with rm_slug=rm_user_form_edit_sub to RM_Front_Form_Controller::edit_sub(). Attacker-controlled form_id and submission_id values are passed to create_form_prefilled() and save_edited_submission() without authentication, ownership validation or a submission-bound nonce. Submitted field values then replace the selected submission, and update_user_profile() writes the edited profile fields to the non-administrator WordPress account identified by the submitted email address. Version 6.0.9.4 binds the edit to the authorized email, verifies the form/submission owner and a nonce, and rejects privileged user-meta keys.
- Component
- RegistrationMagic
- Plugin slug
registrationmagic- Affected
- < 6.0.9.4
- Safe version
6.0.9.4- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 18 known issues for this plugin.
Update, patch or deactivate.
Update RegistrationMagic to 6.0.9.4 or later. Review recently edited submissions and associated non-administrator user profiles for unexpected changes, including custom metadata. Reset affected profile data from trusted records and terminate RegistrationMagic front-end OTP sessions if tampering is suspected.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N