REGISTRATIONMAGIC · CVE-2026-110989 · Package
NO FIX YET · SEE WHAT TO DO
The RegistrationMagic WordPress plugin before 6.1.0.4 updates a WordPress user account using an email address submitted on a public form without checking that the submitter owns it. An unauthenticated attacker can overwrite the profile fields of non-administrator users.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the RegistrationMagic WordPress plugin before 6.1.0.4 that expose a public form with name and primary-email fields. The flaw lets an attacker change the profile of any non-administrator user whose email they submit, so sites without such a public form are likely not reachable this way. Whether a given site has such a form is unknown from the sources.
Not affected if no-public-registration-form, plugin-version-6.1.0.4-or-later
Who cares registrationmagic, wordpress
6.1.0.4 are affected.6.1.0.4 or later, per the sources' 'before 6.1.0.4' range.The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.