EUVD-2026-66290
GHSA-5hgx-prqh-5qmp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Administrative authentication (PR:H) gates access to the vulnerable parameter; scope changes to the database layer (S:C) enable limited cross-schema reads with no integrity or availability impact.
Primary rating from CISA-ADP.
CVSS VectorCISA-ADP
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.
AnalysisAI
SQL injection in the RegistrationMagic WordPress plugin (all versions before 6.0.9.4) permits authenticated administrators to inject arbitrary SQL through an unsanitized parameter. The CVSS Scope:Changed metric indicates the injected query can reach beyond the WordPress application boundary into the underlying database layer, enabling cross-schema data reads. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid WordPress administrator account (PR:H per CVSS vector) - low-privilege subscribers, editors, or contributors cannot trigger this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 4.1 is calibrated by the PR:H requirement - exploitation is gated behind valid WordPress administrator credentials, substantially narrowing the realistic attacker population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained WordPress administrator credentials - through phishing, credential stuffing, or a separate compromise - authenticates to the WordPress admin panel and submits a crafted request to the RegistrationMagic plugin containing a SQL injection payload in the vulnerable parameter. The unsanitized value is passed directly into a database query, allowing the attacker to execute UNION-based or blind SQL injection techniques to extract WordPress database contents or, given the Scope:Changed rating, data from other schemas on the same database server. … |
| Remediation | Update the RegistrationMagic WordPress plugin to version 6.0.9.4 or later using the standard WordPress plugin update interface or the plugin repository; this is the vendor-released patch per advisory data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Registrationmagic
View allIn the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (wi
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) t
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (wi
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requ
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. Rated high severity (CVSS 8.1), this vuln
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name paramet
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attac
Authentication bypass in the RegistrationMagic WordPress plugin (versions up to and including 6.0.8.6) allows unauthenti
The RegistrationMagic - User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to pr
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today