CVE-2026-1054

The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.6.9/admin/controllers/class_rm_options_controller.php#L209
https://plugins.trac.wordpress.org/changeset/3444777/
https://www.wordfence.com/threat-intel/vulnerabilities/id/daf4d246-85f3-48b3-985f-982fea4772f1?source=cve

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El plugin RegistrationMagic para WordPress es vulnerable a la falta de autorización en versiones hasta la 6.0.7.4, inclusive. Esto se debe a la falta de verificación de nonce y de comprobaciones de capacidad en el manejador de acciones AJAX rm_set_otp. Esto permite a atacantes no autenticados modificar configuraciones arbitrarias del plugin, incluyendo claves de reCAPTCHA, configuraciones de seguridad y títulos de menú de frontend.

28 Jan 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-28 08:16

Updated : 2026-06-17 10:14

NVD link : CVE-2026-1054

Mitre link : CVE-2026-1054

CVE.ORG link : CVE-2026-1054

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-1054", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1054", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T14:43:07.271146Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "metagauss", "product": "RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0.7.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-28T08:16:03.230", "references": [{"url": "https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.6.9/admin/controllers/class_rm_options_controller.php#L209", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset/3444777/", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/daf4d246-85f3-48b3-985f-982fea4772f1?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles."}, {"lang": "es", "value": "El plugin RegistrationMagic para WordPress es vulnerable a la falta de autorizaci\u00f3n en versiones hasta la 6.0.7.4, inclusive. Esto se debe a la falta de verificaci\u00f3n de nonce y de comprobaciones de capacidad en el manejador de acciones AJAX rm_set_otp. Esto permite a atacantes no autenticados modificar configuraciones arbitrarias del plugin, incluyendo claves de reCAPTCHA, configuraciones de seguridad y t\u00edtulos de men\u00fa de frontend."}], "lastModified": "2026-06-17T10:14:55.140", "sourceIdentifier": "security@wordfence.com"}