{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32498", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:12:07.663Z", "datePublished": "2026-03-25T16:14:59.903Z", "dateUpdated": "2026-04-29T09:52:00.404Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "custom-registration-form-builder-with-submission-manager", "product": "RegistrationMagic", "vendor": "Metagauss", "versions": [{"changes": [{"at": "6.0.7.7", "status": "unaffected"}], "lessThanOrEqual": "<= 6.0.7.6", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S. (m3ez) | Patchstack Bug Bounty Program"}], "datePublic": "2026-03-25T17:12:38.160Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.</p>"}], "value": "Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-29T09:52:00.404Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-7-6-broken-access-control-vulnerability-2?_s_id=cve"}], "title": "WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T19:21:06.279214Z", "id": "CVE-2026-32498", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:21:28.823Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32498", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T19:21:06.279214Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T19:19:07.040Z"}}], "cna": {"title": "WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Supakiad S. (m3ez) | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Metagauss", "product": "RegistrationMagic", "versions": [{"status": "affected", "changes": [{"at": "6.0.7.7", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "<= 6.0.7.6"}], "packageName": "custom-registration-form-builder-with-submission-manager", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-03-25T17:12:38.160Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-7-6-broken-access-control-vulnerability-2?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects RegistrationMagic: from n/a through <= 6.0.7.6.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-25T16:14:59.903Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32498", "state": "PUBLISHED", "dateUpdated": "2026-03-26T19:21:28.823Z", "dateReserved": "2026-03-12T11:12:07.663Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-25T16:14:59.903Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 6.0.7.6."}, {"lang": "es", "value": "Vulnerabilidad de Falta de Autorizaci\u00f3n en Metagauss RegistrationMagic constructor de formularios de registro personalizados con gestor de env\u00edos permite Explotar Niveles de Seguridad de Control de Acceso Mal Configurados. Este problema afecta a RegistrationMagic: desde n/d hasta &lt;= 6.0.7.6."}], "id": "CVE-2026-32498", "lastModified": "2026-04-24T16:35:20.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-25T17:17:01.680", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-7-6-broken-access-control-vulnerability-2?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.0.7.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "RegistrationMagic", "source": "cna", "vendor": "Metagauss"}, "product": "registrationmagic", "vendor": "metagauss"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-26T22:06:55.771713+00:00", "value": {"mitigation_remediation": ["Verify the current plugin version; any release older than 6.0.7.7 is vulnerable.", "Download and install the latest RegistrationMagic plugin version from the official source.", "After updating, review the plugin\u2019s settings to enforce appropriate access control levels for all registration forms.", "If updating immediately is not possible, disable the plugin or restrict site access using additional security plugins or network firewalls until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Broken Access Control allowing unauthorized access to protected resources"}, "threat_synthesis": {"affected_systems": "All WordPress sites that have the Metagauss RegistrationMagic custom\u2011registration\u2011form\u2011builder\u2011with\u2011submission\u2011manager plugin installed at a version of 6.0.7.6 or earlier are affected. The issue applies regardless of other security measures in place, as it originates in the plugin code.", "description_and_impact": "This vulnerability is a missing authorization flaw that lets attackers bypass the plugin\u2019s configured access control levels. Because the plugin does not enforce proper permission checks, an attacker can read or modify registration forms or submission data that should be restricted to administrators. The flaw is classified under CWE\u2011862 and can compromise the confidentiality and integrity of user data.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity level, while the EPSS score of less than 1% suggests that exploitation is unlikely but still possible. The vulnerability is not listed in CISA\u2019s KEV catalog. Based on the description, it is inferred that an attacker could exploit this flaw by sending crafted HTTP requests to the plugin\u2019s endpoints from any remote location, making the attack vector remote via the web. No additional prerequisites are stated, so any external user with internet access to the affected site could potentially target the weakness."}}}}, "created": "2026-03-25T21:43:30.442337+00:00", "updated": "2026-03-27T09:31:03.641486+00:00", "vendors": ["metagauss", "metagauss$PRODUCT$registrationmagic", "wordpress", "wordpress$PRODUCT$wordpress"]}