CVE-2026-110989: RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission

Q: Which sites are exposed to this issue?

Sites using RegistrationMagic versions before 6.1.0.4 are exposed if they have a publicly accessible form containing name and primary-email fields. The issue affects WordPress accounts that are not administrators.

Q: What does an attacker need to exploit it?

An attacker does not need to authenticate. They need access to a public RegistrationMagic form that includes name and primary-email fields, and can submit an email address associated with a non-administrator WordPress user.

Q: What changes can an attacker make?

An attacker can overwrite profile fields for an arbitrary non-administrator user account associated with the submitted email address. The provided information does not indicate that administrator accounts are affected.

Q: How can the issue be remediated?

Update RegistrationMagic to version 6.1.0.4 or later. Until updating is possible, restrict public access to RegistrationMagic forms that contain both name and primary-email fields.

Published Nov 15, 2026

Updated

The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.

Affected Software

1 affected component

RegistrationMagic RegistrationMagic>=5.2.3.1<=6.1.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.1.0.4

Event History

Nov 15, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using RegistrationMagic versions before 6.1.0.4 are exposed if they have a publicly accessible form containing name and primary-email fields. The issue affects WordPress accounts that are not administrators.

What does an attacker need to exploit it?

An attacker does not need to authenticate. They need access to a public RegistrationMagic form that includes name and primary-email fields, and can submit an email address associated with a non-administrator WordPress user.

What changes can an attacker make?

An attacker can overwrite profile fields for an arbitrary non-administrator user account associated with the submitted email address. The provided information does not indicate that administrator accounts are affected.

How can the issue be remediated?

Update RegistrationMagic to version 6.1.0.4 or later. Until updating is possible, restrict public access to RegistrationMagic forms that contain both name and primary-email fields.

CVE-2026-110989: RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What does an attacker need to exploit it?

What changes can an attacker make?

How can the issue be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What does an attacker need to exploit it?

What changes can an attacker make?

How can the issue be remediated?