CVE-2025-15403: 
WordPress vulnerability analysis and mitigation

CVE-2025-15403 is a Privilege Escalation vulnerability in the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress, affecting all versions up to and including 6.0.7.1. The flaw allows unauthenticated attackers to manipulate the plugin's menu generation logic to grant manage_options (administrative) capability to arbitrary user roles, though full privilege escalation requires at least a subscriber-level account. It was disclosed on January 16–17, 2026, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, Red Hat CVE).

The root cause is Improper Privilege Management (CWE-269): the plugin's add_menu function is exposed via the unauthenticated rm_user_exists AJAX action without proper access controls, allowing arbitrary updates to the admin_order setting. An attacker can inject an empty slug into the order parameter, corrupting the plugin's menu generation logic so that when the WordPress admin menu is subsequently built, the plugin incorrectly assigns the manage_options capability to the targeted user role. The vulnerable code paths are located in class_rm_admin.php (line 487) and class_rm_options_controller.php (line 562). A public PoC exploit has since appeared on GitHub (WordPress Trac, GitHub PoC).

Successful exploitation grants full WordPress administrative capabilities (manage_options) to a subscriber-level or higher user account, enabling complete control over the WordPress installation including configuration changes, user management, content modification, and potential installation of malicious plugins or themes. This represents a full confidentiality, integrity, and availability compromise of the affected WordPress site. The attack can serve as a stepping stone for lateral movement within a hosting environment or for deploying web shells and persistent backdoors (Wordfence, Red Hat CVE).

As of the initial disclosure in January 2026, no public proof-of-concept exploit was confirmed; however, a PoC repository (CVE-2025-15403) subsequently appeared on GitHub in mid-2026, and the vulnerability was indexed on Sploitus, indicating weaponization has occurred (GitHub PoC, Sploitus). No confirmed in-the-wild exploitation or specific threat actor attribution has been reported. The EPSS score is approximately 0.076% (low probability of near-term exploitation), and the vulnerability is not listed in the CISA KEV catalog (Feedly). Exploitation requires a two-step process: unauthenticated manipulation of the AJAX endpoint, followed by a subscriber-level account to complete privilege escalation.

1. Reconnaissance: Identify WordPress sites running the RegistrationMagic plugin (versions ≤ 6.0.7.1) using tools like WPScan, Shodan, or by checking /wp-content/plugins/custom-registration-form-builder-with-submission-manager/ for version indicators.
2. Trigger the vulnerable AJAX action: Send an unauthenticated HTTP POST request to the target site's WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to rm_user_exists and an empty slug injected into the order parameter (e.g., action=rm_user_exists&order[]=&...), targeting the desired user role.
3. Corrupt the admin_order setting: The malformed request causes the add_menu function to write an empty slug into the admin_order plugin setting, poisoning the menu generation logic.
4. Trigger admin menu rebuild: Wait for or trigger a WordPress admin page load, which causes the plugin to rebuild the admin menu and incorrectly assign manage_options capability to the targeted role.
5. Escalate privileges: Log in with a subscriber-level (or higher) account that belongs to the targeted role. The account now has full administrative (manage_options) capabilities, granting complete control over the WordPress installation (Wordfence, GitHub PoC).

• Network: Unusual unauthenticated POST requests to /wp-admin/admin-ajax.php with action=rm_user_exists and anomalous or empty order parameters; repeated requests from the same IP targeting this endpoint.
• Logs: WordPress access logs showing POST requests to admin-ajax.php with rm_user_exists action from unauthenticated sessions; WordPress debug logs showing unexpected capability assignments during admin menu construction.
• Database: Changes to the admin_order option in the WordPress wp_options table with empty or malformed slug values; unexpected manage_options capability entries in user role records in wp_user_roles.
• User Accounts: Subscriber-level or other low-privilege accounts suddenly appearing in the WordPress admin panel or exhibiting administrative behavior; unexpected new administrator accounts created after the initial exploitation.

The primary remediation is to update the RegistrationMagic plugin to a version newer than 6.0.7.1; the patch is available via the WordPress plugin repository changeset 3440797 (WordPress Trac Changeset). As an interim measure, disable the RegistrationMagic plugin entirely or restrict access to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) at the network or WAF level for unauthenticated users. Administrators should audit existing user roles and capabilities in the WordPress database to detect and revert any unauthorized manage_options assignments. Implementing a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=rm_user_exists from unauthenticated sources is also recommended (Wordfence).

Wordfence, the discovering and reporting CNA, included this vulnerability in their weekly WordPress vulnerability report for January 12–18, 2026, highlighting it as a critical privilege escalation issue (Wordfence Blog). The vulnerability received social media attention on Mastodon and Bluesky via security news accounts shortly after disclosure. Qualys added detection for the vulnerability (detection IDs 733602 and 530845) and included it in their January 2026 application security detections report (Qualys). A technical write-up was also published by Infinitsec detailing the exploitation mechanism (Infinitsec).