CVE-2026-0929 in RegistrationMagic Plugin
Summary
by MITRE • 02/16/2026
The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/18/2026
The vulnerability identified as CVE-2026-0929 affects the RegistrationMagic WordPress plugin version 6.0.7.2 and earlier, presenting a critical authorization flaw that undermines the plugin's security model. This issue stems from insufficient capability checks within the plugin's form creation functionality, which allows users with subscriber-level permissions or higher to generate new forms on the WordPress site. The flaw represents a direct violation of the principle of least privilege, where users should only have access to functionality appropriate to their assigned roles within the system.
The technical implementation of this vulnerability lies in the plugin's failure to properly validate user capabilities before executing form creation operations. WordPress employs a robust capability-based access control system where different user roles possess specific permissions that should restrict access to administrative functions. Subscribers in WordPress typically have minimal permissions and should not be able to create forms that could potentially be used for malicious purposes such as data collection or phishing attacks. The absence of capability checks means that any user who can log into the site with subscriber privileges can bypass normal access controls and create forms, effectively elevating their privileges through indirect means.
From an operational standpoint, this vulnerability creates significant risks for WordPress site administrators and their users. Attackers who can obtain subscriber accounts or compromise such accounts can leverage this flaw to create forms that might collect sensitive user data, redirect traffic to malicious sites, or be used as part of broader attack vectors. The impact extends beyond simple privilege escalation since form creation capabilities can be weaponized to harvest credentials, personal information, or other sensitive data from site visitors. This vulnerability particularly concerns sites that rely heavily on user-generated content or have complex registration workflows, as it provides unauthorized users with additional attack surface and potential data exfiltration points.
The vulnerability aligns with CWE-285, which addresses insufficient authorization checks, and represents a clear violation of the principle of least privilege in system design. From an ATT&CK framework perspective, this issue maps to T1078 Valid Accounts and T1566 Phishing, as compromised subscriber accounts can be used to create malicious forms that facilitate further attacks. The lack of proper capability validation creates an indirect path for privilege escalation that bypasses normal WordPress security mechanisms. Organizations should prioritize immediate remediation by upgrading to RegistrationMagic plugin version 6.0.7.2 or later, which implements proper capability checks. Additionally, administrators should review existing forms created by lower-privilege users and consider implementing additional monitoring for form creation activities. The vulnerability underscores the importance of thorough security testing and capability validation in WordPress plugin development, particularly for plugins that handle user data or provide administrative functions to non-administrator users.