/Vulnerability Library

RegistrationMagic <= 6.0.7.1 - Privilege Escalation

CVE-2025-15403
Verified

Description

RegistrationMagic WordPress plugin <= 6.0.7.1 contains a privilege escalation caused by improper access control in 'add_menu' via 'rm_user_exists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation.

Severity

Critical

CVSS Score

9.8

Exploit Probability

2%

Affected Product

registrationmagic

Published Date

August 24, 2026

Template Author

0x_akoko, pdresearch

CVE-2025-15403.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2025-15403
CWE ID:
cwe-269

References

https://github.com/Nxploited/CVE-2025-15403https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registrationmagic/https://nvd.nist.gov/vuln/detail/CVE-2025-15403

Remediation Steps

Update to the latest version beyond 6.0.7.1.