RegistrationMagic CVE-2025-11204

The SQL injection requires the attacker to be authenticated to the target WordPress site with administrator privileges or higher (PR:H), and to reach the vulnerable reports functionality (class_rm_reports_service.php) where a user-supplied parameter is insufficiently escaped and the SQL query is not properly prepared; it affects all RegistrationMagic versions up to and including 6.0.6.2. The secondary reflected XSS requires NO authentication but depends on a crafted User-Agent header supplied during form submission being later rendered to a victim, so it is gated by that reflection path and victim interaction rather than by privileges. Limiting factors: the high administrator privilege requirement sharply constrains the SQLi to insider or post-compromise scenarios, while the XSS is bounded to the reflected form-submission context.

The primary SQL injection carries CVSS 7.2 but its real-world priority is materially lower than that number implies because the CVSS vector itself specifies PR:H - exploitation requires an already-authenticated administrator (or higher). An administrator on a WordPress site already has extensive privileged access, so the incremental risk of the SQLi is limited to pivoting from application-level admin to raw database access; it is not a path for an external, unprivileged attacker. The signals are consistent rather than conflicting: EPSS is low (0.41%, 33rd percentile), there is no CISA KEV listing and no public exploit identified, which aligns with the high privilege barrier. The genuinely more exposed element is the secondary reflected XSS, which the description states can be triggered by an UNAUTHENTICATED attacker via a crafted User-Agent header on form submission - however, the provided CVSS vector (AV:N/AC:L/PR:H/UI:N) describes the SQLi path only and does NOT model the unauthenticated XSS, so the single 7.2 score understates the unauth XSS reachability while overstating the practical severity of the admin-only SQLi. Net assessment: not an urgent, widely-exploitable priority; treat as a routine-to-moderate patch item, prioritizing sites where low-trust users hold administrator roles or where the unauthenticated XSS vector is a concern.

An authenticated administrator (or a compromised/low-trust admin account) submits a crafted value to the vulnerable parameter handled by the plugin's reports service, appending additional SQL to an unprepared query to read sensitive data such as user credentials or PII from the WordPress database. Separately and without authentication, an attacker submits a form with a malicious User-Agent header that is later reflected unescaped, achieving reflected Cross-Site Scripting against whoever views it. No public exploit identified at time of analysis.