CVE-2023-49831 is a high severity (CVSS 7.5) missing authorization flaw in the RegistrationMagic WordPress plugin through version 5.2.3.0. No login is needed. Patchstack lists 5.2.3.1 as the fixed version, though it rates the practical priority Low, so update and check your forms.
What's affected
The NVD record says RegistrationMagic is affected from n/a through 5.2.3.0. The weakness is CWE-862 (missing authorization). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N: reachable over the network, no privileges, high integrity impact.
Source conflict on severity: NVD scores it 7.5 (High). Patchstack repeats the 7.5 score and no login requirement, but labels its own priority Low and says exploitation is unlikely. Both can hold, since a base score measures the worst case and a priority label reflects how likely and useful an attack is. Treat the plugin as needing an update either way.
Fixed version: 5.2.3.1, per Patchstack. Confirm in the plugin changelog. Because the flaw needs no account, the plugin version is the thing to check first, not the user list.
How to check if you're exposed
List installed plugins and versions with WP-CLI, or open Plugins in the WordPress admin.
wp plugin list --fields=name,version,update
Any RegistrationMagic version up to and including 5.2.3.0 is in range. The plugin is named custom-registration-form-builder-with-submission-manager in the plugin list. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Check each WordPress site for the RegistrationMagic plugin.
- Update to 5.2.3.1 or later and test your registration forms.
- Review form settings and recent submissions for changes you did not make.
- If you cannot update, deactivate the plugin until you can.
- Use a staging site to test plugin updates before production when forms drive revenue.
Why it matters
Missing authorization means a plugin function is reachable without a check on who is calling. Here the effect is on data integrity: someone could change what the plugin stores or how a form behaves, with no login.
Patchstack's Low priority reflects that the advice is still to update, and that no widespread attack was recorded in the sources I read. This CVE is not on the CISA KEV list.
Quick check
Why do the sources disagree on severity?
NVD uses the base score of 7.5. Patchstack keeps that score but rates its priority Low because it judges exploitation unlikely.
Does exploitation need a login?
No. The vector and Patchstack both show no privileges required.
Sources
Last reviewed: 19 October 2026.
