The vulnerability arises from the RegistrationMagic WordPress plugin lacking any authorization, ownership, or nonce validation when a user submits a form edit through the front‑end. This omission allows an unauthenticated actor to overwrite data that belongs to other non‑administrator WordPress accounts, effectively corrupting their form submissions and personal profile fields. The flaw is a classic example of CWE‑639, where a lack of access control enables data modification across user accounts.

WordPress sites using the RegistrationMagic plugin on any version earlier than 6.0.9.4 are affected; all older releases expose the edit‑submission endpoint without proper authentication checks.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests that widespread exploitation is unlikely at present, and the vulnerability is not included in the CISA KEV catalog. However, because the attack vector is a publicly reachable front‑end form, any attacker can trigger the flaw without credentials, making it a low‑effort, high‑impact risk for sites that continue to run vulnerable plugin versions.