CVE-2026-15257

CVE-2026-15257 in RegistrationMagic is an unauthenticated IDOR (Insecure Direct Object Reference) that lets any visitor modify other users' WordPress profile fields and form submissions. The CVSS 5.3 score understates the actual risk. Here's why and what you should do about it. The vulnerability allows an unauthenticated attacker to overwrite the email address and other profile data of any registered user in the system. This isn't just profile tampering—RegistrationMagic uses WordPress profile fields as its user identification layer for form submission attribution and notification routing. When you change a victim's email address through this IDOR, you redirect all future form submission notifications tied to that account to an address you control. For sites using RegistrationMagic's webhook, CRM, or email list integrations, the compromised email becomes the primary identifier passed downstream. This creates a persistent man-in-the-middle position that survives the patch itself. An attacker who modifies a victim's profile, then gets caught, leaves the victim still owning an email address they didn't set. If you patch without auditing profile integrity, the positioning persists. What to check: First, determine if RegistrationMagic is active on your WordPress deployment and identify the version. Versions prior to 6.0.9.4 are vulnerable. Second, audit user profile records in wp_users and wp_usermeta for email addresses that don't match the account owner's legitimate address—look for accounts where the email was changed recently or to domains unrelated to your organization. Third, review notification routing logs for any redirection patterns or delivery anomalies around the time of potential exploitation. Do not treat the CVSS 5.3 as a deprioritization signal. The EPSS score of 0.0019 reflects observed exploitation in patched populations, not the actual exploitability of unpatched legacy installations. WordPress plugin ecosystems have well-documented patching lag measured in years, and this IDOR requires zero authentication—exploitation is trivial. Treat the EPSS as a 'probability in observed patching-compliant populations' metric, not a 'difficulty of exploitation' metric. This authorization failure pattern—unauthenticated IDOR against profile fields feeding into plugin user-identification—has appeared in Contact Form 7, WPForms, and Gravity Forms before RegistrationMagic. The scoring frameworks don't adapt for known-repeat vulnerability classes. Your threat model should.

Reviewed through automated stages and approved by a human before publication.