RegistrationMagic <= 6.1.0.3 - Unauthenticated Insecure Direct Object Reference to User Profile Modification via Form Submission
- ID
- WPSEC-2026-3016
- Plugin
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (custom-registration-form-builder-with-submission-manager)
- Affected
- all versions before 6.1.0.4
- Remediation
- Update to 6.1.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- RegistrationMagic on WPSec AttackSurface
- Fix released
- Published
Description
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Insecure Direct Object Reference via front-end form submissions in all versions up to, and including, 6.1.0.3. This is due to the form submission handler looking up an existing WordPress account by the email address in the submitted form and writing the submitted profile field values to that account without checking that the submitter owns it. This makes it possible for unauthenticated attackers to overwrite profile data of other non-administrator users, such as first and last name, nickname, biographical info, website, display name and user meta that the form maps to profile fields. The attacker submits a form rendered by the legacy [RM_Form] shortcode, for example a contact form, using the victim's email address.
References
- https://wpsec.com/vuln/WPSEC-2026-3016/
- https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.4/
- https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS