CVE-2026-15255 is an authorization bypass vulnerability in the RegistrationMagic WordPress plugin prior to version 6.0.9.4. The plugin fails to properly verify that a one-time password presented in a cookie corresponds to the identity requesting front-end form submissions. This flaw enables unauthenticated attackers to access other users' form submission data, including personal information, violating access controls. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An unauthenticated attacker can read sensitive personal information submitted by other users through front-end forms. This compromises user privacy and data confidentiality but does not affect data integrity or availability. The CVSS score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates and avoid exposing sensitive form data until a fix is available.