Binesh Madharapu

The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before updating the associated WordPress user account, allowing unauthenticated attackers to overwrite the profile fields of arbitrary non-administrator users by submitting a public form that contains name and primary-email fields.

High-privileged users can perform Server-Side Request Forgery (SSRF) attacks during a CSV import. This occurs because the plugin fails to validate a user-supplied URL before the server requests it.

Insufficient enforcement of the `promote users` capability within the front-end import functionality allows users who possess only the `create users` capability to modify the roles of existing users, which can lead to privilege escalation to the administrator role.