{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32498", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:12:07.663Z", "datePublished": "2026-03-25T16:14:59.903Z", "dateUpdated": "2026-03-25T16:14:59.903Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "custom-registration-form-builder-with-submission-manager", "product": "RegistrationMagic", "vendor": "Metagauss", "versions": [{"changes": [{"at": "6.0.7.7", "status": "unaffected"}], "lessThanOrEqual": "<= 6.0.7.6", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S. (m3ez) | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:38.160Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.</p>"}], "value": "Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:59.903Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-7-6-broken-access-control-vulnerability-2?_s_id=cve"}], "title": "WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6."}], "id": "CVE-2026-32498", "lastModified": "2026-03-25T17:17:01.680", "metrics": {}, "published": "2026-03-25T17:17:01.680", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-7-6-broken-access-control-vulnerability-2?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.0.7.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "RegistrationMagic", "source": "cna", "vendor": "Metagauss"}, "product": "registrationmagic", "vendor": "metagauss"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-25T18:34:13.208194+00:00", "value": {"mitigation_remediation": ["Check for and install the latest version of the RegistrationMagic plugin (v6.0.7.7 or later) to receive the fix for the access control flaw.", "If an update is not yet available, disable or remove the RegistrationMagic plugin from the WordPress site until a patch is released.", "Review user roles and permissions associated with the plugin to ensure no privilege escalation is possible.", "Conduct a quick audit of the site's registration and form submission flows to confirm that unauthorized access is no longer possible."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access to Protected Resources"}, "threat_synthesis": {"affected_systems": "WordPress installations running the Metagauss RegistrationMagic custom\u2011registration\u2011form\u2011builder\u2011with\u2011submission\u2011manager plugin, versions up to 6.0.7.6 (including any prior releases). The flaw applies to all affected WordPress sites that have the vulnerable plugin installed.", "description_and_impact": "The vulnerability is a missing authorization flaw in the RegistrationMagic plugin that allows an attacker to perform actions or access data that should be restricted. Because the plugin fails to enforce proper access control checks, an attacker could exploit improperly configured security levels to read or modify sensitive information. This weakness is classified as broken access control and can potentially compromise the confidentiality and integrity of user data.", "risk_and_exploitability": "No CVSS or EPSS scores are publicly available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely deployed exploit yet. Attackers would need to interact with the compromised plugin's endpoints or UI, possibly from a remote web connection to the affected WordPress site. The risk is high for sites that expose registration or form submission functionality, as unauthorized users could abuse these features. Because the flaw is straightforward to exploit once the vulnerability is known, the likelihood of exploitation remains significant, especially if the site has become public and the plugin remains unpatched."}}}}, "created": "2026-03-25T21:43:30.442337+00:00", "updated": "2026-03-26T11:37:29.992637+00:00", "vendors": ["metagauss", "metagauss$PRODUCT$registrationmagic", "wordpress", "wordpress$PRODUCT$wordpress"]}