RegistrationMagic CVE-2026-82225

Exploitation requires that the target WordPress site has the RegistrationMagic plugin installed and active in a version at or below 6.0.9.8. The CVSS AC:H metric indicates that some specific condition beyond plugin presence must be met - likely a particular plugin configuration, an enabled sub-feature, or a timing/state dependency - though the available description does not enumerate the exact prerequisite. The CVSS PR:N metric confirms no WordPress credentials or authenticated session are required. UI:N means no victim interaction is needed. What limits exploitation is the AC:H complexity requirement, the absence of any known public exploit code, and the necessity that the target site runs this specific plugin version; WordPress sites not running RegistrationMagic are entirely unaffected.

The CVSS 3.1 base score of 7.4 (High) is driven primarily by the dual C:H/I:H impact and PR:N (unauthenticated) access, partially offset by AC:H which signals that exploitation is not trivially repeatable against arbitrary targets. The AC:H metric is the critical moderating factor: it implies a specific race condition, timing requirement, or non-default configuration state that must be present for the bypass to succeed, meaningfully reducing the automatable exploitation risk compared to an AC:L equivalent. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified independently. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit code has been identified, suggesting opportunistic mass exploitation is not currently occurring. However, WordPress plugin authentication bypasses are a highly targeted class - once a working technique is documented in a Patchstack advisory, weaponization by threat actors targeting WordPress installations typically follows quickly. The C:H and I:H impact ratings indicate that a successful exploit could expose sensitive registrant PII and allow unauthorized creation, modification, or deletion of form submissions or user accounts.

An unauthenticated remote attacker identifies a WordPress site running RegistrationMagic <= 6.0.9.8 and, under the specific conditions required by AC:H, sends a crafted HTTP request that invokes an alternate authentication path - such as a direct AJAX endpoint or REST route lacking proper capability checks - thereby bypassing the plugin's authentication gate. With authentication bypassed, the attacker can read sensitive registration submissions (C:H) or manipulate form data, user records, or plugin configuration (I:H) without ever possessing valid WordPress credentials. No public proof-of-concept has been identified, but the Patchstack disclosure provides sufficient technical context for capable threat actors to develop working exploits.