← back to popular plugins
wordfence / plugin · custom-registration-form-builder-with-submission-manager
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
custom-registration-form-builder-with-submission-manager
total installs
7,000
total vulns
27
critical
3
high
6
medium
18
low
0
latest vuln
—
patched
27
unpatched
0
avg time to patch
—
vulnerabilities
(27)
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.9 - Unauthenticated Stored Cross-Site Scripting
high
✓ patched
cve id
CVE-2026-77792 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Sep 3, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 6.0.9.9. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
RegistrationMagic <= 6.0.9.8 - Authentication Bypass
critical
✓ patched
cve id
CVE-2026-77826 ↗
cvss score
9.8
cwe
CWE-288: Authentication Bypass Using an Alternate Path or Channel
published
Sep 3, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9.8. This makes it possible for unauthenticated attackers to bypass authentication.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.8 - Unauthenticated Stored Cross-Site Scripting
high
✓ patched
cve id
CVE-2026-82221 ↗
cvss score
7.2
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Aug 31, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.0.9.8. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
RegistrationMagic <= 6.0.9.8 - Unauthenticated Payment Bypass
medium
✓ patched
cve id
CVE-2026-77793 ↗
cvss score
5.3
cwe
CWE-602: Client-Side Enforcement of Server-Side Security
published
Aug 31, 2026
The RegistrationMagic plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 6.0.9.8. This is due to a lack of server-side payment verification. This makes it possible for unauthenticated attackers to bypass payments.
RegistrationMagic <= 6.0.9.8 - Unauthenticated Payment Bypass
medium
✓ patched
cve id
CVE-2026-77794 ↗
cvss score
5.3
cwe
CWE-602: Client-Side Enforcement of Server-Side Security
published
Aug 31, 2026
The RegistrationMagic plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 6.0.9.8. This is due to a lack of server-side payment verification. This makes it possible for unauthenticated attackers to bypass payments.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.8 - Authentication Bypass
high
✓ patched
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9.8. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, which may be administrators.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Authenticated (Administrator+) SQL Injection
medium
✓ patched
cve id
CVE-2026-77790 ↗
cvss score
4.9
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Aug 26, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to 6.0.9.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 - Unauthenticated PHP Object Injection
high
✓ patched
cve id
CVE-2026-73341 ↗
cvss score
8.1
cwe
CWE-502: Deserialization of Untrusted Data
published
Aug 18, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.0.9.7. This is due to deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Unauthenticated Insecure Direct Object Reference
medium
✓ patched
cve id
CVE-2026-15255 ↗
cvss score
5.3
cwe
CWE-639: Authorization Bypass Through User-Controlled Key
published
Jul 30, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to 6.0.9.4 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Missing Authorization
medium
✓ patched
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 6.0.9.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.
RegistrationMagic <= 6.0.9.4 - Unauthenticated Price Manipulation
medium
✓ patched
cve id
CVE-2026-15208 ↗
cvss score
5.3
cwe
CWE-602: Client-Side Enforcement of Server-Side Security
published
Jul 20, 2026
The RegistrationMagic plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 6.0.9.4. This is due to a lack of server-side verification of the captured payment amount, currency, invoice ID, and custom payment key against the locally stored payment log in the PayPal SDK callback handler. This makes it possible for unauthenticated attackers to bypass payment requirements and complete paid form registrations without making a valid payment by supplying a PayPal capture ID for an arbitrary or previously completed transaction.
RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
high
✓ patched
cve id
CVE-2026-12158 ↗
cvss score
8.8
cwe
CWE-352: Cross-Site Request Forgery (CSRF)
published
Jun 30, 2026
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
medium
✓ patched
cve id
CVE-2026-9242 ↗
cvss score
5.3
cwe
CWE-345: Insufficient Verification of Data Authenticity
published
Jun 26, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN `callback` handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data — including `payment_status` and the `custom` field encoding the target `user_id` — before PayPal IPN validation is performed, meaning the database remains poisoned even when validation subsequently fails. This makes it possible for unauthenticated attackers to authenticate as any WordPress user, including administrators, by submitting a forged IPN request that overwrites a payment log entry's `user_id` with that of a target account, then visiting the success return URL with a legitimately obtained security hash to cause the plugin to issue real WordPress authentication cookies for the targeted account.
RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization
medium
✓ patched
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.0.8.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization
medium
✓ patched
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.0.7.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass
critical
✓ patched
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.7.1. This makes it possible for unauthenticated attackers to bypass authentication.
RegistrationMagic <= 6.0.7.6 - Missing Authorization
medium
✓ patched
The RegistrationMagic plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.0.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment
medium
✓ patched
cve id
CVE-2025-14444 ↗
cvss score
5.3
cwe
CWE-345: Insufficient Verification of Data Authenticity
published
Feb 17, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the payment actually went through PayPal. This makes it possible for unauthenticated attackers to bypass paid registration by manipulating payment status and activating their account without completing a real PayPal payment.
RegistrationMagic < 6.0.7.2 - Missing Authorization
medium
✓ patched
The RegistrationMagic plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 6.0.7.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification
medium
✓ patched
The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers to modify arbitrary plugin settings, including reCAPTCHA keys, security settings, and frontend menu titles.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure
medium
✓ patched
cve id
CVE-2025-15520 ↗
cvss score
5.3
cwe
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
published
Jan 23, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.7.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
critical
✓ patched
cve id
CVE-2025-15403 ↗
cvss score
9.8
cwe
CWE-269: Improper Privilege Management
published
Jan 16, 2026
The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. This makes it possible for unauthenticated attackers to injecting an empty slug into the order parameter, and manipulate the plugin's menu generation logic, and when the admin menu is subsequently built, the plugin adds 'manage_options' capability for the target role. Note: The vulnerability can only be exploited unauthenticated, but further privilege escalation requires at least a subscriber user.
RegistrationMagic <= 6.0.6.9 - Cross-Site Request Forgery
medium
✓ patched
cve id
CVE-2026-24374 ↗
cvss score
4.3
cwe
CWE-352: Cross-Site Request Forgery (CSRF)
published
Jan 10, 2026
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.6.9. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.
RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode
medium
✓ patched
cve id
CVE-2025-13610 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Dec 15, 2025
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitization and output escaping on the 'theme' attribute. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection
high
✓ patched
cve id
CVE-2025-11204 ↗
cvss score
7.2
cwe
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
published
Oct 7, 2025
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-2836 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Apr 2, 2025
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.3.3 - Reflected Cross-Site Scripting
medium
✓ patched
cve id
CVE-2025-24686 ↗
cvss score
6.1
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Jan 28, 2025
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 6.0.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.