The vulnerability is a missing authorization flaw in the Metagauss RegistrationMagic WordPress plugin. Because security levels are incorrectly configured, an attacker can access submission data and other protected resources. This Unauthorized Access can lead to confidentiality breaches, potentially exposing user personal data. The weakness aligns with CWE-862, which describes missing authorization checks.

Affected systems include any WordPress installation utilizing Metagauss’ RegistrationMagic plugin with a version of 6.0.7.6 or earlier. The plugin is identified by the vendor asset Metagauss:RegistrationMagic. No specific patch versions are listed in the data, but versions n/a through <= 6.0.7.6 are impacted.

The CVSS score of 5.4 indicates a moderate severity vulnerability. The EPSS score of <1% suggests that exploitation is unlikely, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation would likely involve sending crafted HTTP requests to the plugin’s endpoints without proper authentication. Because the vulnerability stems from incorrect access controls, the attack vector is inferred to be web based. The risk remains present until the plugin is updated or the access controls are remedied.