RegistrationMagic WordPress Plugin Missing Authorization Vulnerability Allowing Unauthenticated Settings Modification

A vulnerability exists in the RegistrationMagic plugin for WordPress, in versions through 6.0.7.4, due to missing nonce verification and capability checks in the rm_set_otp AJAX action handler. This flaw allows unauthenticated attackers to alter various plugin settings, such as reCAPTCHA keys, security options, and frontend menu titles.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of critical plugin settings, potentially allowing for further exploitation or disruption of the affected WordPress site.

Remediation

Users are advised to update the RegistrationMagic plugin to version 6.0.7.5 or a newer patched version.