# RegistrationMagic <= 6.1.0.3 - Unauthenticated Insecure Direct Object Reference to User Profile Modification via Form Submission

- **ID:** WPSEC-2026-3016
- **Plugin:** RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (`custom-registration-form-builder-with-submission-manager`), https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
- **Affected versions:** all versions before 6.1.0.4
- **Fixed in:** 6.1.0.4 (Update to 6.1.0.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3016/

## Description

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Insecure Direct Object Reference via front-end form submissions in all versions up to, and including, 6.1.0.3. This is due to the form submission handler looking up an existing WordPress account by the email address in the submitted form and writing the submitted profile field values to that account without checking that the submitter owns it. This makes it possible for unauthenticated attackers to overwrite profile data of other non-administrator users, such as first and last name, nickname, biographical info, website, display name and user meta that the form maps to profile fields. The attacker submits a form rendered by the legacy [RM_Form] shortcode, for example a contact form, using the victim's email address.

## References

- https://wpsec.com/vuln/WPSEC-2026-3016/
- https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.4/
- https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3016/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.