CVE-2026-15255

The CVSS 5.3 rating for CVE-2026-15255 misrepresents the actual threat because it structurally undervalues scenarios where unauthenticated access to personal form data enables scalable harvesting—not a targeted one-off disclosure. This vulnerability in the RegistrationMagic WordPress plugin allows an attacker to enumerate valid OTP cookie values against the API endpoint and harvest whatever personal data those cookies can access: names, emails, addresses, employment information, and whatever custom fields the forms were configured to collect. The mechanism is a binding failure. The plugin sets an OTP cookie during login and checks only that the cookie exists and corresponds to a valid user—it never verifies that the party holding the cookie is the same entity entitled to the specific data being requested. The OTP was designed to authenticate a login event, not to serve as a session token binding to every subsequent data request. This distinction matters: the system does something (validates a credential) rather than nothing, which creates false confidence while offering lower actual security than no authentication gate at all. What makes this analytically distinct from a generic IDOR is the scale economics. A targeted exploit requires effort per victim. This pattern requires one-time setup, then iteration across an enumerated user base—the harvest is passive, leaves fewer forensic traces, and the EPSS of 0.00202 likely reflects absent tooling rather than absent risk. Attackers who understand this pattern don't need to find a novel vulnerability; they need to find another plugin that inferred

Reviewed through automated stages and approved by a human before publication.