The RegistrationMagic WordPress plugin versions prior to 6.0.9.4 do not perform necessary authorization, ownership, or nonce verification on a front-end submission-editing feature. This lack of checks enables unauthenticated attackers to modify form submissions and profile data belonging to other users who are non-administrators, effectively bypassing authorization controls. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or patch information is currently available.

Unauthenticated attackers can overwrite form submissions and profile fields of non-administrator WordPress accounts, potentially leading to unauthorized data modification and integrity issues within the affected WordPress site. Administrative accounts are not indicated as affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable functionality where possible and monitor for suspicious activity related to form submission edits. Avoid exposing the affected plugin's front-end editing features to unauthenticated users.