606 matches found
CVE-2024-10508
Escalada de privilegios no autenticada a travĆ©s de la recuperaciĆ³n de contraseƱa en RegistrationMagic = 6.0.2.6 Aviso legal : Esta informaciĆ³n se proporciona Ćŗnicamente con fines educativos. Este documento pretende concienciar sobre las vulnerabilidades de seguridad y no debe utilizarse para...
WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection
WordPress RegistrationMagic plugin before 5.0.1.6 contains an authenticated SQL injection vulnerability. The plugin does not escape user input in its rmchronosajax AJAX action before using it in a SQL statement when duplicating tasks in batches. An attacker can possibly obtain sensitive...
RegistrationMagic <= 5.0.1.7 - Authentication Bypass
RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...
RegistrationMagic <= 6.0.7.1 - Privilege Escalation
RegistrationMagic WordPress plugin = 6.0.7.1 contains a privilege escalation caused by improper access control in 'addmenu' via 'rmuserexists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation. id:...
CVE-2026-82221-PoC
CVE-2026-82221 - Unauthenticated Reflected XSS in RegistrationMagic Overview This repository contains a Proof-of-Concept PoC for CVE-2026-82221 , an unauthenticated Reflected Cross-Site Scripting XSS vulnerability discovered in the RegistrationMagic WordPress plugin. The vulnerability affects the...
CVE-2025-15403
CVE-2025-15403 RegistrationMagic š” The intel drops here first. Follow @KNxploited on Telegram ā precision CVE disclosures, working exploits, and deep-dive vulnerability research. The channel for those who don't wait for the news ā they make it. š§ Overview CVE-2025-15403 is a CVSS 9.8 Critical...
CVE-2024-10508
CVE-2024-10508 This tool scans WordPress sites for vulnerabilities in the RegistrationMagic plugin CVE-2024-10508. It checks for the presence of a specific version 6.0.2.6 and marks the site as vulnerable if found. The results are saved in a file vuln.txt for further analysis. Features: Scans...
WordPress RegistrationMagic plugin < 6.0.9.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Charles Vosburgh in WordPress Plugin RegistrationMagic versions 6.0.9.9...
CVE-2026-77826
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
EUVD-2026-71848
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
CVE-2026-77826
The RegistrationMagic WordPress plugin, in versions prior to 6.0.9.9 (specifically 5.0.1.8 through 6.0.9.8 ), is vulnerable to an unauthenticated authentication bypass . The root cause is a failure to validate the audience of a Facebook access token , meaning the plugin does not verify which appl...
CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
PT-2026-86330
šØ CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and l...
CVE-2026-77826: Improper Authentication
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...
WordPress RegistrationMagic plugin < 6.0.9.9 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin RegistrationMagic versions 6.0.9.9...
CVE-2026-77794
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...
CVE-2026-77793
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...
CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...
CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...