CVE-2026-0929

Vulnerability

Overview The RegistrationMagic WordPress plugin, versions prior to 6.0.7.2, fails to properly enforce capability checks when creating forms. This missing authorization (CWE-862) allows any authenticated user with at least the Subscriber role to create new forms on the site [1].

Exploitation

An attacker who has obtained a subscriber-level account (or higher) can exploit this flaw by navigating to the form creation functionality. No additional privileges are required beyond a standard subscriber account. The plugin does not verify that the user has the necessary permissions (e.g., edit_posts or manage_options) before allowing form creation [1].

Impact

By creating arbitrary forms, an attacker could craft forms to collect sensitive information from other users, such as login credentials or personal data, potentially leading to further compromise. The ability to create forms without authorization undermines the site's access control model and can be used for phishing or data exfiltration attacks.

Mitigation

The vulnerability has been fixed in version 6.0.7.2 of the RegistrationMagic plugin. Users are strongly advised to update to this version or later to prevent unauthorized form creation [1].