The vulnerability arises because the RegistrationMagic WordPress plugin fails to confirm that a one‑time password presented in a cookie matches the identity requested before delivering front‑end form submissions. This oversight allows an attacker to read other users’ form submissions, which may contain personally identifiable information. The weakness falls under the CWE‑639 category of Insecure Direct Object References, resulting in a moderate confidentiality impact.

Any WordPress site that has the RegistrationMagic plugin installed with a version older than 6.0.9.4 is affected. The issue does not depend on other plugins or themes and applies to all user roles that can trigger the form‑submission endpoint.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score of less than 1% suggests that exploitation is considered unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request that carries a one‑time password cookie; the attacker can craft such a request to access any user’s form submission data.