CVE-2026-0929: RegistrationMagic Auth Bypass Vulnerability

CVE-2026-0929 Overview

The RegistrationMagic WordPress plugin before version 6.0.7.2 contains a Missing Authorization vulnerability (CWE-862) that allows authenticated users with subscriber-level permissions or higher to create forms on the site without proper capability checks. This broken access control flaw enables low-privileged users to perform administrative actions they should not have access to.

Critical Impact

Authenticated attackers with minimal privileges (subscriber role) can create arbitrary forms on affected WordPress sites, potentially leading to unauthorized data collection, phishing campaigns, or further site compromise.

Affected Products

• RegistrationMagic WordPress plugin versions prior to 6.0.7.2

Discovery Timeline

• 2026-02-16 - CVE-2026-0929 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-0929

Vulnerability Analysis

This vulnerability stems from a Missing Authorization flaw (CWE-862) in the RegistrationMagic WordPress plugin. The plugin fails to implement proper capability checks on form creation functionality, allowing users with low-privilege roles such as subscribers to access and utilize administrative features intended only for site administrators.

The attack can be executed over the network by any authenticated user, requiring no user interaction. While the vulnerability does not directly impact data confidentiality or system availability, it allows unauthorized modification of site content through the creation of forms, representing an integrity violation.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks within the plugin's form creation functionality. WordPress plugins should verify user capabilities using functions like current_user_can() before allowing access to sensitive operations. The RegistrationMagic plugin fails to implement these checks adequately, permitting subscribers and other low-privileged users to bypass the intended access controls.

Attack Vector

The attack is conducted over the network and requires the attacker to have an authenticated session with at least subscriber-level privileges on the target WordPress site. The attacker can directly access the form creation functionality without elevated permissions due to the missing capability checks.

An attacker would need to:

1. Register or obtain a subscriber-level account on the target WordPress site
2. Authenticate to the WordPress dashboard
3. Access the RegistrationMagic plugin's form creation endpoints
4. Create arbitrary forms without proper authorization

The vulnerability is exploitable with low attack complexity and requires no user interaction, making it relatively straightforward for authenticated attackers to abuse.

Detection Methods for CVE-2026-0929

Indicators of Compromise

• Unexpected form creation events in WordPress activity logs attributed to non-administrator users
• New forms appearing in the RegistrationMagic plugin that were not created by authorized administrators
• Subscriber or contributor accounts accessing plugin administrative endpoints

Detection Strategies

• Monitor WordPress audit logs for form creation activities by low-privileged user roles
• Implement Web Application Firewall (WAF) rules to detect unauthorized access to RegistrationMagic administrative endpoints
• Regularly audit the list of forms in RegistrationMagic to identify unauthorized creations

Monitoring Recommendations

• Enable comprehensive logging for all WordPress plugin activities, particularly form-related operations
• Set up alerts for any form creation events initiated by users without administrator or editor roles
• Periodically review user role assignments to ensure appropriate privilege levels

How to Mitigate CVE-2026-0929

Immediate Actions Required

• Update the RegistrationMagic WordPress plugin to version 6.0.7.2 or later immediately
• Audit existing forms in the plugin to identify any that may have been created by unauthorized users
• Review user accounts and remove any unnecessary subscriber or higher-level access

Patch Information

The vulnerability has been addressed in RegistrationMagic version 6.0.7.2. Site administrators should update to this version or later through the WordPress plugin update mechanism. For detailed information about the vulnerability and remediation, consult the WPScan Vulnerability Report.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the RegistrationMagic plugin until the update can be applied
• Restrict user registrations on the WordPress site to minimize the number of authenticated users who could exploit the vulnerability
• Implement additional server-level access controls to restrict access to plugin administrative endpoints

# Check current RegistrationMagic plugin version via WP-CLI
wp plugin list --name=custom-registration-form-builder-with-submission-manager --fields=name,version,update_version

# Update RegistrationMagic plugin to the latest version
wp plugin update custom-registration-form-builder-with-submission-manager

# Verify the update was successful
wp plugin list --name=custom-registration-form-builder-with-submission-manager --fields=name,version