CVE-2026-1054 is a missing authorization vulnerability (CWE-862) in the RegistrationMagic plugin for WordPress by metagauss. The flaw arises because the rm_set_otp AJAX action handler does not perform nonce verification or capability checks, enabling unauthenticated attackers to alter arbitrary plugin settings including security-related parameters. This affects versions up to and including 6.0.7.4. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker can modify plugin settings without authorization. This includes changing reCAPTCHA keys, security settings, and frontend menu titles, potentially weakening the security posture of the affected WordPress site. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, restrict access to the AJAX handler if possible or disable the plugin until a patch is available. Monitor vendor channels for updates and apply patches promptly once released.