CVE-2026-110989 in RegistrationMagic Plugin
Summary
by MITRE • 11/15/2026
The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/15/2026
The vulnerability identified in RegistrationMagic versions prior to 6.1.0.4 represents a critical failure in identity verification within WordPress plugin architecture, specifically categorized under CWE-287 Improper Authentication. This flaw stems from the application's logic which processes form submissions to update user profile data without implementing any mechanism to verify that the email address provided by the attacker actually belongs to them or matches the intended target account securely. In a standard secure implementation, updating sensitive personal information such as an email address requires proof of ownership, typically through a confirmation link sent to the new email address or re-authentication with existing credentials. The absence of this check allows for direct manipulation of user attributes via public-facing forms that are accessible without any authentication requirements.
From a technical perspective, the exploit relies on the ability of unauthenticated actors to interact with specific form endpoints exposed by the plugin. By submitting a POST request containing name and primary-email fields through these publicly available forms, an attacker can force the system to overwrite the profile information of arbitrary non-administrator users. This process bypasses standard WordPress security checks because the vulnerability exists within the custom logic of the RegistrationMagic plugin rather than in core authentication mechanisms. The lack of validation means that if a user has registered with email A and name B, an attacker can submit form data specifying email C and name D, resulting in the target account being associated with the new credentials without any verification step to confirm control over email C or authorization from the original owner.
The operational impact of this vulnerability is significant for both individual site administrators and enterprise environments relying on WordPress for user management. The primary consequence is a complete compromise of user identity integrity within the application. Attackers can hijack accounts by changing the associated email address, which may facilitate further attacks such as password resets if the platform relies solely on email-based recovery mechanisms. Additionally, this capability allows for reputation damage and data corruption, as attackers can alter names and other profile details to misrepresent users or inject malicious content into user profiles that might be displayed publicly. This also undermines trust in the system's ability to maintain accurate user records, which is critical for compliance with regulations requiring strict identity management such as GDPR or HIPAA depending on the nature of the data stored.
This vulnerability aligns closely with MITRE ATT&CK technique T1098.004 Account Manipulation: Email Address Modification, where adversaries alter account properties to maintain persistence or escalate privileges. It also reflects CWE-602 Client-Side Enforcement of Server-Side Security, as the application fails to enforce security controls on the server side during data processing. The risk is exacerbated by the fact that many WordPress sites use such plugins for membership management, lead generation, and customer relationship management, making them attractive targets for automated scanning tools seeking easy wins in user account manipulation.
Mitigation strategies must focus on immediate patching and architectural improvements. Site administrators should upgrade RegistrationMagic to version 6.1.0.4 or later where this issue has been addressed by implementing proper ownership verification protocols. In the interim, before an update can be applied, it is advisable to restrict access to public forms that handle user data updates, requiring authentication for any action that modifies profile fields. Implementing CAPTCHA on these forms can also help mitigate automated exploitation attempts. Furthermore, developers should audit other plugins and custom code for similar patterns of unverified input processing when dealing with sensitive user attributes, ensuring that all changes to identity-related fields are validated against established security standards such as OWASP's guidelines for session management and data validation. Regular security audits and penetration testing can help identify these types of logic flaws before they are exploited in production environments.