{
 "id": "WPSEC-2026-3016",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3016/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3016/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3016/index.md",
 "title": "RegistrationMagic <= 6.1.0.3 - Unauthenticated Insecure Direct Object Reference to User Profile Modification via Form Submission",
 "description": "The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Insecure Direct Object Reference via front-end form submissions in all versions up to, and including, 6.1.0.3. This is due to the form submission handler looking up an existing WordPress account by the email address in the submitted form and writing the submitted profile field values to that account without checking that the submitter owns it. This makes it possible for unauthenticated attackers to overwrite profile data of other non-administrator users, such as first and last name, nickname, biographical info, website, display name and user meta that the form maps to profile fields. The attacker submits a form rendered by the legacy [RM_Form] shortcode, for example a contact form, using the victim's email address.",
 "plugin": {
  "slug": "custom-registration-form-builder-with-submission-manager",
  "name": "RegistrationMagic",
  "full_name": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login",
  "wordpress_org": "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/custom-registration-form-builder-with-submission-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.1.0.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.1.0.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.1.0.4",
 "remediation": "Update to 6.1.0.4 or later.",
 "fix_released": "2026-11-12T04:37:11+00:00",
 "published": "2026-11-13T04:42:27+00:00",
 "updated": "2026-11-12T17:14:28.652070+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3016/",
  "https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.4/",
  "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}