Skip to content
Sign in
6.6 Medium

CVE-2023-2548 The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and…

Description

The RegistrationMagic plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 5.2.0.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated attackers, with administrator-level permissions and above, to change user passwords and potentially take over super-administrator accounts in multisite setup.

Affected products and versions

Product Affected versions Fixed in
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login 5.2 earliest → 5.2.0.5 No fix stated

Other CVEs of RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

The 15 CVEs of RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login →
CVE-2026-12158 The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request… 8.8 High CVE-2026-9242 The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is… 5.3 Medium CVE-2025-14444 The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is… 5.3 Medium CVE-2026-1054 The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including,… 5.3 Medium
Track this CVE