CVE-2026-49764: WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability

Synopsis

Broken authentication vulnerability in the RegistrationMagic WordPress plugin (versions 6.0.8.6 and earlier) allows a remote, unauthenticated attacker to bypass the authentication mechanism entirely. The flaw is reachable over the network with no credentials, no special account, and no victim interaction required. Successful exploitation gives an attacker full read, write, and denial-of-service capability over the affected system. No upstream fix has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild as soon as one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends crafted HTTP requests directly to the WordPress installation from any internet-accessible endpoint.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the authentication bypass is exploitable by a completely anonymous attacker.

• Victim interactionNot required

  The exploit executes entirely through direct attacker-to-server requests and requires no action from any user or administrator of the target site.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free with no race conditions, memory-layout dependencies, or environmental prerequisites to satisfy.

Blast Radius

• Reads any data accessible to the WordPress application, including user credentials, session tokens, private form submissions, and stored personal data.
• Writes or modifies persisted database rows, including user account records, plugin configuration, and published content.
• Creates or escalates attacker-controlled accounts by manipulating the registration and authentication flow the plugin manages.
• Crashes or degrades the affected WordPress service by abusing authenticated-only operations that enforce no access check.