WordPress Plugin Vulnerabilities
RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission
Description
The plugin does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.
Proof of Concept
Affects Plugins
Fixed in 6.1.0.4 References
CVE
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
BINESH MADHARAPU
Submitter
BINESH MADHARAPU
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-11-13 (about 2 days ago)
Added
2026-11-13 (about 1 day ago)
Last Updated
2026-11-13 (about 1 day ago)
