CVE-2025-15520

Medium · 4.3

CVSS

4.3

EPSS

0.2%

Published

Feb 13, 2026

CISA due date

—

The record

The RegistrationMagic WordPress plugin before 6.0.7.2 checks nonces but not capabilities, allowing for the disclosure of some sensitive data to subscribers and above.

Affected packages

Ecosystem	Package	Introduced	Fixed