Vulnerability record/PUBLISHED/Published Nov 15, 2026 06:00:07 UTC
CVE-2026-110989
The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 15, 2026 06:00:07 UTC
PublishedNov 15, 2026 06:00:07 UTC
ReservedOct 15, 2026 11:32:14 UTC
Credits
- BINESH MADHARAPU
- WPScan