CVE-2025-15403: RegistrationMagic Privilege Escalation

CVE-2025-15403 Overview

The RegistrationMagic plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 6.0.7.1. This vulnerability stems from improper access controls in the add_menu function, which is accessible via the rm_user_exists AJAX action. Attackers can exploit this flaw to manipulate the plugin's menu generation logic by injecting an empty slug into the order parameter, ultimately granting the manage_options capability to arbitrary user roles.

Critical Impact

Unauthenticated attackers can manipulate WordPress plugin settings to escalate privileges, potentially gaining full administrative control over vulnerable WordPress installations.

Affected Products

• RegistrationMagic plugin for WordPress versions ≤ 6.0.7.1
• WordPress installations using vulnerable RegistrationMagic versions
• Custom Registration Form Builder with Submission Manager (RegistrationMagic plugin)

Discovery Timeline

• January 17, 2026 - CVE-2025-15403 published to NVD
• January 17, 2026 - Last updated in NVD database

Technical Details for CVE-2025-15403

Vulnerability Analysis

This privilege escalation vulnerability (CWE-269: Improper Privilege Management) allows unauthenticated attackers to abuse the rm_user_exists AJAX action to access the add_menu function without proper authorization checks. The vulnerability exists in the plugin's options controller where the admin_order setting can be arbitrarily modified.

When an attacker injects an empty slug into the order parameter, it corrupts the plugin's menu generation logic. Subsequently, when WordPress builds the admin menu, the flawed logic in RegistrationMagic inadvertently assigns the manage_options capability—WordPress's most powerful administrative permission—to the attacker's target role.

While the initial exploitation can be performed unauthenticated, full privilege escalation requires at least a subscriber-level account on the WordPress installation. This two-stage attack makes the vulnerability particularly dangerous as subscriber accounts are commonly available on many WordPress sites with open registration.

Root Cause

The root cause of this vulnerability lies in insufficient access control validation within the add_menu function located in class_rm_admin.php. The function is exposed through the rm_user_exists AJAX endpoint without proper capability checks, allowing any user—including unauthenticated visitors—to modify critical plugin settings. Additionally, the admin_order parameter in the options controller (class_rm_options_controller.php) lacks input validation, enabling attackers to inject malicious values that corrupt the menu generation process.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication for the initial exploitation phase. An attacker can send crafted AJAX requests to the vulnerable rm_user_exists endpoint, manipulating the admin_order setting with an empty slug value.

The exploitation flow involves:

1. Sending an unauthenticated AJAX request to the rm_user_exists action
2. Injecting an empty slug into the admin_order parameter
3. Waiting for an administrator to access the WordPress dashboard (triggering menu generation)
4. The corrupted menu logic assigns manage_options capability to the targeted user role
5. Logging in with a subscriber account that now has administrative privileges

For technical implementation details, refer to the WordPress Plugin Code Snippet and the Options Controller source.

Detection Methods for CVE-2025-15403

Indicators of Compromise

• Unexpected AJAX requests to the rm_user_exists action endpoint from unauthenticated sources
• Modified admin_order settings in the RegistrationMagic plugin options containing empty or malformed values
• User accounts with subscriber role suddenly possessing manage_options capability
• Unusual administrative actions performed by non-administrator accounts

Detection Strategies

• Monitor WordPress AJAX logs for suspicious rm_user_exists requests, particularly those containing empty or unusual parameter values
• Implement Web Application Firewall (WAF) rules to detect and block malformed requests to the wp-admin/admin-ajax.php endpoint targeting RegistrationMagic actions
• Regularly audit user capabilities using WordPress security plugins to detect unauthorized privilege changes
• Review database entries in the WordPress options table for unexpected modifications to RegistrationMagic settings

Monitoring Recommendations

• Enable comprehensive logging for all AJAX requests on WordPress installations
• Configure alerts for capability changes on user accounts, especially escalation to administrative roles
• Monitor the wp_options table for unexpected modifications to RegistrationMagic-related entries
• Implement real-time security monitoring solutions like SentinelOne Singularity to detect anomalous behavior patterns

How to Mitigate CVE-2025-15403

Immediate Actions Required

• Update RegistrationMagic plugin to a version newer than 6.0.7.1 immediately
• Review all user accounts for unexpected capability assignments and revoke any unauthorized permissions
• Audit recent AJAX activity logs for evidence of exploitation attempts
• Consider temporarily disabling the RegistrationMagic plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in WordPress Plugin Changeset #3440797. Site administrators should update to the latest version of RegistrationMagic through the WordPress plugin repository. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict access to admin-ajax.php for unauthenticated users at the web server level using .htaccess or nginx configuration rules
• Implement a Web Application Firewall (WAF) with rules blocking requests to the rm_user_exists AJAX action
• Disable open user registration on WordPress sites until the plugin is updated
• Monitor and audit user capabilities regularly using security plugins

# Apache .htaccess workaround to restrict AJAX access
# Add to WordPress root .htaccess file
<Files admin-ajax.php>
    <RequireAny>
        Require ip 127.0.0.1
        Require valid-user
    </RequireAny>
</Files>