{"id":"CVE-2026-110989","kind":"vulnerability","aliases":["CVE-2026-110989"],"related":[],"title":"RegistrationMagic WordPress plugin lets anyone overwrite user profiles","description":"The RegistrationMagic  WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.","summary":"The RegistrationMagic WordPress plugin before 6.1.0.4 updates a WordPress user account using an email address submitted on a public form without checking that the submitter owns it. An unauthenticated attacker can overwrite the profile fields of non-administrator users.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RegistrationMagic","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","registrationmagic","wordpress"],"not_affected_if":["no-public-registration-form","plugin-version-6.1.0.4-or-later"],"how_to_check":"- Check the installed RegistrationMagic plugin version in the WordPress admin under Plugins; versions below `6.1.0.4` are affected.\n- Look for public forms built with RegistrationMagic that collect name and primary-email fields.","fix":"- RegistrationMagic: `6.1.0.4` or later, per the sources' 'before 6.1.0.4' range.","status":"open","published_at":"2026-11-15T07:16:53+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","triaged_at":"2026-11-15T07:36:23+00:00","updated_at":"2026-11-15T07:36:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-15T07:36:23Z","model":"claude-haiku-5-5","output":{"fix":"- RegistrationMagic: `6.1.0.4` or later, per the sources' 'before 6.1.0.4' range.","reach":"internet","title":"RegistrationMagic WordPress plugin lets anyone overwrite user profiles","impact":"medium","summary":"The RegistrationMagic WordPress plugin before 6.1.0.4 updates a WordPress user account using an email address submitted on a public form without checking that the submitter owns it. An unauthenticated attacker can overwrite the profile fields of non-administrator users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","registrationmagic"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes over non-administrator WordPress user accounts via profile overwrite","analyst_note":"","how_to_check":"- Check the installed RegistrationMagic plugin version in the WordPress admin under Plugins; versions below `6.1.0.4` are affected.\n- Look for public forms built with RegistrationMagic that collect name and primary-email fields.","plain_action":"","product_name":"RegistrationMagic","needs_analyst":false,"not_affected_if":["plugin-version-6.1.0.4-or-later","no-public-registration-form"],"who_is_affected":"Sites running the RegistrationMagic WordPress plugin before 6.1.0.4 that expose a public form with name and primary-email fields. The flaw lets an attacker change the profile of any non-administrator user whose email they submit, so sites without such a public form are likely not reachable this way. Whether a given site has such a form is unknown from the sources.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000765,"input_tokens":4556,"output_tokens":618,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110989':11A,14A '-2026':10A,13A '6.1.0.4':24B,64C 'account':29B,80C 'address':33B,73C 'administr':57B,93C 'allow':81C 'anyon':5A 'arbitrari':90C 'associ':77C 'attack':48B,83C 'check':40B 'contain':101C 'cve':9A,12A 'email':32B,72C,106C 'field':53B,88C,107C 'form':38B,99C 'let':4A 'name':102C 'non':56B,92C 'non-administr':55B,91C 'overwrit':6A,50B,85C 'own':44B 'ownership':68C 'packag':16B 'plugin':3A,22B,62C 'primari':105C 'primary-email':104C 'profil':8A,52B,87C 'public':37B,98C 'registrationmag':1A,17B,20B,60C 'registrationmagic':15A 'submit':34B,71C,96C 'submitt':43B 'unauthent':47B,82C 'updat':25B,75C 'use':30B 'user':7A,28B,58B,79C,94C 'verifi':67C 'without':39B 'wordpress':2A,18B,21B,27B,61C,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the RegistrationMagic WordPress plugin before 6.1.0.4 that expose a public form with name and primary-email fields. The flaw lets an attacker change the profile of any non-administrator user whose email they submit, so sites without such a public form are likely not reachable this way. Whether a given site has such a form is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["registrationmagic"],"ptokens":["registrationmagic"],"labels":["high","package","registrationmagic","vendor","wordpress"],"campaign_type":null,"search_a":"'-110989':11A,14A '-2026':10A,13A 'anyon':5A 'cve':9A,12A 'let':4A 'overwrit':6A 'plugin':3A 'profil':8A 'registrationmag':1A 'registrationmagic':15A 'user':7A 'wordpress':2A","search_b":"'6.1.0.4':24B 'account':29B 'address':33B 'administr':57B 'attack':48B 'check':40B 'email':32B 'field':53B 'form':38B 'non':56B 'non-administr':55B 'overwrit':50B 'own':44B 'packag':16B 'plugin':22B 'profil':52B 'public':37B 'registrationmag':17B,20B 'submit':34B 'submitt':43B 'unauthent':47B 'updat':25B 'use':30B 'user':28B,58B 'without':39B 'wordpress':18B,21B,27B","search_c":"'6.1.0.4':64C 'account':80C 'address':73C 'administr':93C 'allow':81C 'arbitrari':90C 'associ':77C 'attack':83C 'contain':101C 'email':72C,106C 'field':88C,107C 'form':99C 'name':102C 'non':92C 'non-administr':91C 'overwrit':85C 'ownership':68C 'plugin':62C 'primari':105C 'primary-email':104C 'profil':87C 'public':98C 'registrationmag':60C 'submit':71C,96C 'unauthent':82C 'updat':75C 'user':79C,94C 'verifi':67C 'wordpress':61C,78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T07:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110989","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110989","severity":null,"published_at":"2026-11-15T07:16:53+00:00","modified_at":"2026-11-15T07:16:53+00:00","first_seen_at":"2026-11-15T07:36:11+00:00","fetched_at":"2026-11-15T07:36:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}