This vulnerability allows an unauthenticated attacker to exploit the 'add_menu' function via the 'rm_user_exists' AJAX action and update the 'admin_order' setting with an empty slug, manipulating the plugin's menu generation logic. When the admin menu is subsequently built, the plugin grants the target role the 'manage_options' capability, effectively elevating privileges to administrative levels. The impact is a complete escalation of privileges from no access to full control of the WordPress site.

The affected product is the RegistrationMagic plugin for WordPress, versions up to and including 6.0.7.1, developed by MetaGauss and used for custom registration forms, user registration, payment, and user login functionality.

The severity reported by CVSS is 9.8, indicating critical impact, while the EPSS score is less than 1% reflecting a very low exploitation probability as of current data. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can trigger exploitation unauthenticated via the public AJAX endpoint; however, further privilege escalation requires the existence of at least a subscriber user account on the WordPress installation.