Medium severity · published Feb 13, 2026
CVE-2025-15520
RegistrationMagic <= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
The RegistrationMagic WordPress plugin before 6.0.7.2 checks nonces but not capabilities, allowing for the disclosure of some sensitive data to subscribers and above.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
RegistrationMagic ·
before 6.0.7.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15520
wpscan.com
https://wpscan.com/vulnerability/996f1c93-4b28-4cec-9d7c-fb66d0addabc/
More from RegistrationMagic
8.8
CVE-2026-77826
RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
7.5
CVE-2026-77792
RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field
5.5
CVE-2026-77790
RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter
5.3
CVE-2026-77794
RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
5.3
CVE-2026-77793
RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field