Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-1054 Missing Authorization Vulnerability in WordPress RegistrationMagic Plugin 6.0.7.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1054
Post summary
The entry announces a missing authorization vulnerability (CVE-2026-1054) in WordPress RegistrationMagic Plugin v6.0.7.4, but it contains no additional technical details, PoC, or patch information.
🚨 CVE-2026-1054: RegistrationMagic WordPress plugin lets anyone change security settings via rm_set_otp AJAX call, no login needed. Attackers can tweak reCAPTCHA keys and more. Patch to 6.0.7.5 now! Full advisory ➡️ https://volerion.com/vulnerabilities/CVE-2026-1054 #WordPress #infosec #AppSec
Post summary
CVE‑2026‑1054 in RegistrationMagic allows unauthenticated users to alter security settings; patch 6.0.7.5 is released and advisory available.