CVE-2026-1054CWE-862

RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification

Medium · published January 28, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
17.3
In the wild
Unconfirmed
What it is

The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-28T07:27Z
EPSS history
Timeline
  • 28 JAN 07:27Z
    RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification
    cvelistv5