Critical · published January 17, 2026
🚨 An unauthenticated attacker can tweak a simple AJAX request to elevate privileges in WordPress's RegistrationMagic plugin! 🔥 Think of it like an uninvited guest sneaking into a restaurant and changing their reservation to a VIP table — with just a few crafty adjustments, they might end up in charge of the whole event! This privilege escalation could allow the attacker to gain admin-level access to your site, potentially letting them change settings, install malicious plugins, or even wipe your site entirely. The fallout could be absolutely devastating for your data integrity and user trust!
Think of it like an uninvited guest sneaking into a restaurant and changing their reservation to a VIP table — with just a few crafty adjustments, they might end up in charge of the whole event! This vulnerability stems from the 'add_menu' function being accessible via the 'rm_user_exists' AJAX action, allowing attackers to manipulate the plugin's menu generation logic by injecting an empty slug into the order parameter. This, in turn, grants excessive capabilities to unauthorized roles.
This privilege escalation could allow the attacker to gain admin-level access to your site, potentially letting them change settings, install malicious plugins, or even wipe your site entirely. The fallout could be absolutely devastating for your data integrity and user trust! Update the RegistrationMagic plugin immediately to version 6.0.7.2 or higher to patch this vulnerability. Additionally, review user roles and permissions to ensure no unauthorized users have elevated access. Always back up your site before making changes! You've got this! Implement these changes and keep your WordPress site secure! 🛡️