---
id: "CVE-2026-110989"
page: "https://infrastack.ai/live/CVE-2026-110989"
kind: "vulnerability"
aliases: ["CVE-2026-110989"]
title: "RegistrationMagic WordPress plugin lets anyone overwrite user profiles"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "RegistrationMagic", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "registrationmagic", "wordpress"]
not_affected_if: ["no-public-registration-form", "plugin-version-6.1.0.4-or-later"]
published_at: "2026-11-15T07:16:53+00:00"
first_seen_at: "2026-11-15T07:36:11+00:00"
updated_at: "2026-11-15T07:36:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110989", "first_seen_at": "2026-11-15T07:36:11+00:00"}]
exploit_sources: []
---

# RegistrationMagic WordPress plugin lets anyone overwrite user profiles

Link for people: https://infrastack.ai/live/CVE-2026-110989 (this .md is for agents)

The RegistrationMagic WordPress plugin before 6.1.0.4 updates a WordPress user account using an email address submitted on a public form without checking that the submitter owns it. An unauthenticated attacker can overwrite the profile fields of non-administrator users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:RegistrationMagic affected range not listed fixed no fixed version listed

## How to check

- Check the installed RegistrationMagic plugin version in the WordPress admin under Plugins; versions below `6.1.0.4` are affected.
- Look for public forms built with RegistrationMagic that collect name and primary-email fields.

## Fix

- RegistrationMagic: `6.1.0.4` or later, per the sources' 'before 6.1.0.4' range.

## Timeline

- 2026-11-15T07:36:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110989

## From the sources

The RegistrationMagic  WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_