What is the CVSS score of CVE-2026-73341?

CVE-2026-73341 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of RegistrationMagic are affected by CVE-2026-73341?

RegistrationMagic WordPress plugin versions 6.0.9.7 and earlier contain a critical unauthenticated PHP object injection vulnerability (CVE-2026-73341, CVSS 9.8) that enables attackers to execute…

How to fix or mitigate CVE-2026-73341?

Within 24 hours: Audit all WordPress instances to identify installations of RegistrationMagic versions 6.0.9.7 or earlier and immediately disable or uninstall the plugin from affected sites if functionally feasible. Within 7 days: Conduct forensic analysis on affected systems for indicators of compromise, including unexpected file changes, database modification logs, and authentication anomalies during the vulnerable exposure period. Within 30 days: Monitor vendor and security advisories for a patch release; test any patch in a staging environment before production deployment; if patch availability remains uncertain, migrate to an alternative registration plugin and rotate all affected database credentials.

RegistrationMagic CVE-2026-73341

EUVD-2026-60771 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-18 Patchstack

GHSA-vw67-q89f-8xcq

PHP WordPress Deserialization Registrationmagic Wordpress Plugin Metagauss

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated (PR:N) network (AV:N) low-complexity deserialization reachable without interaction; worst-case gadget chain yields full C/I/A impact, matching the reported vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:10 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

Articles & Coverage 1

News Critical PHP Object Injection in RegistrationMagic WordPress Plugin - CVE-2026-73341 Aug 19, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application without validation. Depending on the POP gadget chains available in the plugin, WordPress core, or other installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack with a CVSS 9.8; no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed in the wild.

Technical ContextAI

The affected software is RegistrationMagic (CPE cpe:2.3:a:metagauss:registrationmagic), a Metagauss-developed WordPress plugin marketed as a custom registration form builder with a submission manager. The root cause is CWE-502 (Deserialization of Untrusted Data): attacker-controlled input reaches a PHP unserialize() call (or equivalent) without sanitization. PHP object injection is dangerous because unserializing untrusted data instantiates arbitrary object instances and triggers magic methods (__wakeup, __destruct, __toString), enabling a 'property-oriented programming' (POP) gadget chain assembled from any class loaded in the WordPress runtime - plugin, theme, or core - to be abused for file writes/reads, SQL injection, or code execution even though the plugin itself may ship no directly dangerous gadget.

RemediationAI

Upgrade RegistrationMagic to a version later than 6.0.9.7 once released by Metagauss; the input identifies 6.0.9.7 as the last vulnerable version but does not confirm an exact patched release number, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/custom-registration-form-builder-with-submission-manager/vulnerability/wordpress-registrationmagic-plugin-6-0-9-7-php-object-injection-vulnerability) for the fixed version - Patch availability per vendor advisory; released patched version not independently confirmed from the provided data. If an update cannot be applied immediately, deploy a WAF/virtual patch (Patchstack or equivalent) to block serialized PHP object payloads to the plugin's registration endpoints, restrict or disable public registration forms that accept untrusted input, and consider deactivating the plugin on high-exposure sites (trade-off: registration functionality is lost). Removing other unnecessary plugins reduces the pool of POP gadget chains available to an attacker, lowering practical exploitability.