Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: RegistrationMagic 6.0.9.4 Clear all filters
TI-2026-12845 CVE-2026-15257 · GHSA-vgp8-mh5v-wf9p

RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification

Priority MEDIUM 63

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-07-30 Fixed in 6.0.9.4 CWE-639
TI-2026-12843 CVE-2026-15255 · GHSA-vm2x-vwh2-372v

RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR

Priority LOW 30

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowin…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00323 Published 2026-07-30 Fixed in 6.0.9.4 CWE-639