CVE-2026-15255 is an authorization bypass vulnerability in the RegistrationMagic WordPress plugin prior to version 6.0.9.4. The vulnerability arises because the plugin does not validate that a one-time password presented in a cookie belongs to the user requesting the data. As a result, attackers can retrieve form submission data of other users without authentication, leading to unauthorized disclosure of potentially sensitive personal information. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or official remediation details are currently available.

An unauthenticated attacker can exploit this vulnerability to read form submission data belonging to other users. This can lead to exposure of personal and sensitive information submitted via the plugin's forms. The breach of confidentiality may have privacy and compliance implications depending on the nature of the data exposed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 6.0.9.4, upgrading to version 6.0.9.4 or later (once confirmed by the vendor) is recommended. Until an official fix is available, restrict access to the affected plugin's functionality and monitor for unusual access patterns related to form submissions.