CVE-2025-15403 is a critical security vulnerability identified in the RegistrationMagic WordPress plugin, which is widely used for custom registration forms, user registration, payment processing, and user login management. The flaw stems from improper privilege management (CWE-269) in the plugin's 'add_menu' function, which is accessible through the 'rm_user_exists' AJAX action. This function allows unauthenticated attackers to inject an empty slug into the 'admin_order' parameter, manipulating the plugin's menu generation logic. As a result, when the WordPress admin menu is constructed, the plugin inadvertently assigns the 'manage_options' capability—normally reserved for administrators—to the targeted user role. Although the initial exploitation vector requires no authentication, further privilege escalation to full administrative rights requires the attacker to have at least subscriber-level access. This vulnerability affects all versions up to and including 6.0.7.1 of RegistrationMagic. The CVSS v3.1 base score of 9.8 reflects the vulnerability's ease of exploitation (network vector, no privileges, no user interaction) and its severe impact on confidentiality, integrity, and availability. No official patches or exploit code are currently published, but the risk of exploitation remains high due to the plugin's popularity and the critical nature of the flaw.

For European organizations, this vulnerability poses a significant risk to WordPress-based websites using the RegistrationMagic plugin. Successful exploitation can lead to unauthorized administrative access, enabling attackers to modify site settings, inject malicious code, steal sensitive user data, disrupt services, or pivot to other internal systems. The compromise of administrative privileges undermines the confidentiality and integrity of data and can cause prolonged downtime or defacement, impacting business operations and reputation. Organizations in sectors with strict data protection requirements, such as finance, healthcare, and government, face heightened regulatory and compliance risks if exploited. Additionally, the vulnerability's unauthenticated attack vector increases the likelihood of automated scanning and exploitation attempts, making timely mitigation critical.

Given the absence of an official patch at the time of this report, European organizations should implement immediate compensating controls. These include disabling or restricting access to the 'rm_user_exists' AJAX action via web application firewalls (WAFs) or custom server rules to block unauthorized requests. Limiting subscriber user roles and auditing existing user permissions can reduce the risk of privilege escalation. Monitoring WordPress logs for unusual AJAX activity related to RegistrationMagic is advised. Organizations should also consider temporarily deactivating the RegistrationMagic plugin if feasible until a patch is released. Once available, promptly apply vendor patches or updates. Employing a principle of least privilege for WordPress roles and enforcing multi-factor authentication for administrative accounts further mitigates risk. Regular backups and incident response preparedness are essential to recover from potential compromises.