RegistrationMagic for WordPress contains an incorrect privilege assignment flaw (CWE‑266). This vulnerability enables an attacker to elevate a user’s role beyond the intended permissions, resulting in account takeover. The flaw can be triggered by supplying crafted input through the plugin’s registration or submission handling, which leads to unauthorized escalation within the WordPress site.

Metagauss’ RegistrationMagic plugin versions up to and including 6.0.7.1 are vulnerable. Sites running any of those releases on WordPress installations are affected; no additional information is available about newer versions.

The CVSS score of 8.1 rates this issue as high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of active exploitation. Based on the description, it is inferred that the attack vector is remote, relying on manipulating plugin requests to trigger the privilege escalation. No local privilege or special conditions are required other than an active WordPress site using a vulnerable RegistrationMagic version.