Vulnerability · Published Jan 17, 2026 · Assigned by Wordfence

CVE-2025-15403RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

Critical 9.8

In plain English

A critical-severity privilege mismanagement in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login from metagauss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.7%top 23.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. This makes it possible for unauthenticated attackers to injecting an empty slug into the order parameter, and manipulate the plugin's menu generation logic, and when the admin menu is subsequently built, the plugin adds 'manage_options' capability for the target role. Note: The vulnerability can only be exploited unauthenticated, but further privilege escalation requires at least a subscriber user.

Affected products (as reported)

Vendor	Product	Versions
metagauss	RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login	0 – through 6.0.7.1

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References