CVE-2026-15255 Overview
CVE-2026-15255 affects the RegistrationMagic WordPress plugin in versions prior to 6.0.9.4. The plugin fails to validate that a one-time password (OTP) presented in a cookie belongs to the identity being requested before returning front-end form submissions. Unauthenticated attackers can read other users' form submission data, including personal information. The flaw represents an Insecure Direct Object Reference (IDOR) combined with broken access control on stored submissions.
Critical Impact
Unauthenticated attackers can access personal information submitted by other users through RegistrationMagic forms without authorization.
Affected Products
- RegistrationMagic WordPress plugin versions before 6.0.9.4
- WordPress sites using RegistrationMagic for user registration and form workflows
- Deployments exposing front-end form submission retrieval endpoints
Discovery Timeline
- 2026-07-30 - CVE-2026-15255 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-15255
Vulnerability Analysis
RegistrationMagic implements a workflow where a one-time password is stored in a browser cookie and used to authorize access to previously submitted form data. The plugin returns form submissions based on the requested identity without verifying that the OTP in the cookie matches that identity. This decoupling of authentication material from authorization checks allows an attacker to request submissions belonging to arbitrary users while presenting an unrelated or crafted OTP cookie.
The issue enables horizontal privilege escalation across form submitters. Because RegistrationMagic stores personal information collected through registration forms — names, email addresses, phone numbers, and custom fields — the exposure directly affects data protected under privacy regulations.
Root Cause
The root cause is a missing authorization check on the front-end submission retrieval endpoint. The plugin trusts the identity parameter supplied in the request without cross-referencing it against the OTP session material bound to the cookie. This pattern maps to Broken Access Control and Insecure Direct Object Reference weaknesses.
Attack Vector
An unauthenticated remote attacker interacts with the plugin's public submission retrieval endpoint. The attacker supplies a target user identifier and any OTP-shaped cookie value the endpoint accepts. Because the server does not verify that the cookie's OTP corresponds to the requested identity, the response returns another user's submission payload. The attack requires no authentication, no privileges, and no user interaction from the victim.
See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-15255
Indicators of Compromise
- Repeated requests to RegistrationMagic front-end submission endpoints iterating over sequential user or submission identifiers
- Successful HTTP 200 responses containing form submission payloads without a preceding authenticated session
- Anomalous cookie values presented on submission retrieval requests that do not match any issued OTP
Detection Strategies
- Review web server and WordPress access logs for enumeration patterns against RegistrationMagic endpoints
- Correlate submission retrieval responses with the OTP issuance events to identify mismatched identity access
- Alert on high-volume access to /wp-admin/admin-ajax.php or plugin-specific routes tied to RegistrationMagic
Monitoring Recommendations
- Enable verbose logging on the RegistrationMagic plugin and WordPress REST endpoints
- Deploy a web application firewall rule to log and inspect requests carrying RegistrationMagic OTP cookies
- Track outbound response sizes on submission endpoints to flag bulk data exposure
How to Mitigate CVE-2026-15255
Immediate Actions Required
- Update the RegistrationMagic plugin to version 6.0.9.4 or later on all WordPress installations
- Audit form submission logs for evidence of unauthorized access prior to patching
- Notify affected users if submission data exposure is confirmed, per applicable privacy regulations
Patch Information
Upgrade RegistrationMagic to version 6.0.9.4 or later, which enforces validation that the OTP cookie belongs to the identity being requested before returning submission data. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable or restrict access to RegistrationMagic front-end submission retrieval features until the patch is applied
- Restrict access to WordPress plugin endpoints via IP allowlisting or authentication proxies
- Invalidate active OTP cookies and rotate any session material issued by the plugin after upgrading
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
