CVE-2026-15255
RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR
CVSS Score
5.3
EPSS Score
0.1%
EPSS Percentile
4th
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
| Vendor | unknown |
| Product | registrationmagic |
| Published | Jul 30, 2026 |
| Last Updated | Jul 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown registrationmagic
Be the first to know when new medium vulnerabilities affecting unknown registrationmagic are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / RegistrationMagic
0 < 6.0.9.4
References
Credits
Jonatan Buskila WPScan