RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
custom-registration-form-builder-with-submission-manager · plugin
Known security vulnerabilities for RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. Find out in seconds which version runs on your site with WP Lens.
46 known vulnerabilities
7 critical · 31 exploitable without logging in · 4 with public exploit code · latest Aug 31, 2026
Listed on wordpress.org · latest 6.1.0.1 · last updated Sep 24, 2026 · 7K+ installs
wordpress.org status checked on Oct 5, 2026
Vulnerabilities
- Critical 9.8
CVE-2026-73341unauthenticated≤ 6.0.9.7
WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability
- Critical 9.8
CVE-2026-49764unauthenticated≤ 6.0.8.6
WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability
- Critical 9.8
CVE-2025-15403unauthenticated≤ 6.0.7.1
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
- Critical 9.8
CVE-2017-20208unauthenticated→ 3.7.9.3
RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
- Critical 9.8
CVE-2024-10508unauthenticated≤ 6.0.2.6
RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery
- Critical 9.8
CVE-2023-2499unauthenticated≤ 5.2.1.0
RegistrationMagic <= 5.2.1.0 - Authentication Bypass
- Critical 9.8
CVE-2024-25935login required≤ 5.2.5.9
WordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerability
- High 8.8
CVE-2026-12158unauthenticated≤ 6.0.9.1
RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
- High 8.8
CVE-2023-47645unauthenticated · needs a click≤ 5.2.2.6
WordPress RegistrationMagic Plugin <= 5.2.2.6 is vulnerable to Cross Site Request Forgery (CSRF)
- High 8.8
CVE-2023-25991unauthenticated · needs a click≤ 5.1.9.2
WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)
- High 8.8
CVE-2020-9454unauthenticated · needs a click
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a
- High 8.8
CVE-2024-1991subscriber+≤ 5.3.0.0
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation
- High 8.8
CVE-2020-9458login required
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privilege
- High 8.8
CVE-2020-9457login required
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vuln
- High 8.8
CVE-2020-9456login required
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privilege
- High 8.8
CVE-2024-1990contributor+≤ 5.3.1.0
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode
- High 8.1
CVE-2026-24373unauthenticated≤ 6.0.7.1
WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability
- High 8.1
CVE-2021-4073unauthenticated≤ 5.0.1.7
RegistrationMagic <= 5.0.1.7 Authentication Bypass
- High 8.1
CVE-2020-8435login required
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress.
- High 7.5
CVE-2026-32498unauthenticated≤ <= 6.0.7.6
WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability
- High 7.5
CVE-2023-49831unauthenticated≤ 5.2.3.0
WordPress RegistrationMagic plugin <= 5.2.3.0 - Broken Access Control vulnerability
- High 7.5
CVE-2023-51543unauthenticated≤ 5.2.5.0
WordPress RegistrationMagic plugin <= 5.2.5.0 - IP Limit Bypass vulnerability
- High 7.5
CVE-2023-23976unauthenticated≤ 5.1.9.2
WordPress RegistrationMagic plugin <= 5.1.9.2 - Arbitrary Price Change
- High 7.4
CVE-2026-82225unauthenticated≤ 6.0.9.8
WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
- High 7.2
CVE-2025-11204admin≤ 6.0.6.2
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection
- High 7.2
CVE-2023-50846high privilege≤ 5.2.4.5
WordPress RegistrationMagic Plugin <= 5.2.4.5 is vulnerable to SQL Injection
- High 7.2
CVE-2023-2548admin≤ 5.2.0.5
RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change
- High 7.1
CVE-2026-82221unauthenticated · needs a click≤ 6.0.9.8
WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
- Medium 6.5
CVE-2023-23989unauthenticated≤ 5.1.9.2
WordPress RegistrationMagic plugin <= 5.1.9.2 - Content Injection
- Medium 6.4
CVE-2025-2836subscriber+≤ 6.0.4.3
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- Medium 6.4
CVE-2025-13610contributor+≤ 6.0.6.7
RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode
- Medium 6.1
CVE-2025-24686unauthenticated · needs a click≤ 6.0.3.3
WordPress RegistrationMagic Plugin <= 6.0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability
- Medium 6.1
CVE-2024-43317unauthenticated · needs a click≤ 6.0.1.0
WordPress RegistrationMagic plugin <= 6.0.1.0 - Cross Site Scripting (XSS) vulnerability
- Medium 6.1
CVE-2024-39643unauthenticated · needs a click≤ 6.0.0.1
WordPress RegistrationMagic plugin <= 6.0.0.1 - Cross Site Scripting (XSS) vulnerability
- Medium 6.1
CVE-2024-33947unauthenticated · needs a click≤ 5.3.2.0
WordPress RegistrationMagic plugin <= 5.3.2.0 - Cross Site Scripting (XSS) vulnerability
- Medium 6.1
CVE-2024-29113unauthenticated · needs a click≤ 5.2.5.9
WordPress RegistrationMagic plugin <= 5.2.5.9 - Reflected Cross Site Scripting (XSS) vulnerability
- Medium 6.1
CVE-2023-51509unauthenticated · needs a click≤ 5.2.4.1
WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS)
- Medium 6.1
CVE-2020-8436unauthenticated · needs a click
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.
- Medium 5.4
CVE-2026-24374unauthenticated · needs a click≤ 6.0.6.9
WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability
- Medium 5.4
CVE-2026-32385login required≤ 6.0.7.6
WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability
- Medium 5.3
CVE-2025-14444unauthenticated≤ 6.0.6.9
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_
- Medium 5.3
CVE-2026-1054unauthenticated≤ 6.0.7.4
RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification
- Medium 5.3
CVE-2023-51544unauthenticated≤ 5.2.5.0
WordPress RegistrationMagic plugin <= 5.2.5.0 - Form Submission Limit Bypass vulnerability
- Medium 5.3
CVE-2026-9242subscriber+≤ 6.0.8.6
RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
- Medium 4.3
CVE-2024-2951unauthenticated · needs a click≤ 5.3.0.0
WordPress RegistrationMagic plugin <= 5.3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- Medium 4.3
CVE-2020-9455login required
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary ema
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).