CVE-2026-24373
Published: 25 March 2026
Summary
CVE-2026-24373 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-24373 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the Metagauss RegistrationMagic WordPress plugin, also known as custom-registration-form-builder-with-submission-manager. This flaw allows privilege escalation and affects all versions from n/a through 6.0.7.1. The vulnerability received a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite requiring high attack complexity.
Unauthenticated attackers can exploit this vulnerability remotely over the network without user interaction. Successful exploitation enables privilege escalation, potentially leading to account takeover as indicated in vulnerability details, with high impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-7-1-account-takeover-vulnerability?_s_id=cve provides further details on the account takeover vulnerability in RegistrationMagic version 6.0.7.1. Security practitioners should consult this reference for specific mitigation guidance, such as updating to a patched version.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15569
Vulnerability details
Incorrect Privilege Assignment vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Privilege Escalation.This issue affects RegistrationMagic: from n/a through <= 6.0.7.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation via unauthenticated remote exploitation of a public-facing WordPress plugin (CWE-266).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2026-24373 by requiring identification, reporting, and correction of the incorrect privilege assignment flaw in the RegistrationMagic plugin through patching.
Enforces least privilege to prevent privilege escalation from unauthenticated attackers exploiting the incorrect privilege assignment in the plugin.
Manages account creation, privilege assignment, and reviews to counter unauthorized escalations resulting from the plugin's vulnerability.