CVE-2024-10508

在 RegistrationMagic = 6.0.2.6 上通过密码恢复实现未经身份验证的权限提升 免责声明 ：此信息仅供参考和教育目的。本文档旨在提高对安全漏洞的认识，不应被用于任何未经授权或恶意的活动。未经许可利用这些漏洞的行为是非法且不道德的。 用于 WordPress 的 RegistrationMagic – User Registration Plugin with Custom Registration Forms 插件在 6.0.2.6...

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...

RegistrationMagic <= 6.0.7.1 - Privilege Escalation

RegistrationMagic WordPress plugin = 6.0.7.1 contains a privilege escalation caused by improper access control in 'addmenu' via 'rmuserexists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation. id:...

WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection

WordPress RegistrationMagic plugin before 5.0.1.6 contains an authenticated SQL injection vulnerability. The plugin does not escape user input in its rmchronosajax AJAX action before using it in a SQL statement when duplicating tasks in batches. An attacker can possibly obtain sensitive...

CVE-2026-82221-PoC

CVE-2026-82221 - 未认证反射型XSS漏洞（RegistrationMagic） 概述 本仓库包含 CVE-2026-82221 的概念验证（PoC），该漏洞是在 RegistrationMagic WordPress 插件中发现的一个未认证反射型跨站脚本（XSS）漏洞。 该漏洞影响 RegistrationMagic 提交页面上的 activetab 参数。 攻击者可以构造包含 JavaScript 的恶意 URL，并将其发送给有权访问 RegistrationMagic 提交内容的受害者。当受害者打开该构造的 URL 时，攻击者控制的 JavaScript 将在易受攻击...

CVE-2025-15403

CVE-2025-15403 RegistrationMagic 📡 情报在此率先发布。 在 Telegram 上关注 @KNxploited — 精准的 CVE 披露、可用的漏洞利用代码以及深入的漏洞研究。 这个频道属于那些不等新闻、而是创造新闻的人。 🧠 概述 CVE-2025-15403 是 WordPress 的 RegistrationMagic 插件中的一个 CVSS 9.8 严重级别 权限提升漏洞。 该漏洞存在于插件的 addmenu 函数中，该函数通过 rmuserexists AJAX 动作以未认证方式暴露。攻击者通过向 order 参数注入一个空 slug ，同时附带...

CVE-2024-10508

CVE-2024-10508 此工具扫描WordPress站点中RegistrationMagic 插件的漏洞CVE-2024-10508 。 它会检查特定版本（6.0.2.6）是否存在，如果发现则将该站点标记为易受攻击。 结果保存在文件vuln.txt中，供进一步分析。 功能： 扫描WordPress网站中“RegistrationMagic”插件的漏洞，特别是CVE-2024-10508。 检查插件是否存在易受攻击的版本“6.0.2.6”，并将这些网站标记为易受攻击。 将易受攻击站点的URL保存到结果文件vuln.txt中，以便进一步审查和报告。 请我喝杯咖啡： 比特币 $:...

WordPress RegistrationMagic plugin < 6.0.9.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Charles Vosburgh in WordPress Plugin RegistrationMagic versions 6.0.9.9...

CVE-2026-77826

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

EUVD-2026-71848

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

CVE-2026-77826

The RegistrationMagic WordPress plugin, in versions prior to 6.0.9.9 (specifically 5.0.1.8 through 6.0.9.8 ), is vulnerable to an unauthenticated authentication bypass . The root cause is a failure to validate the audience of a Facebook access token , meaning the plugin does not verify which appl...

CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

PT-2026-86330

🚨 CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and l...

CVE-2026-77826: Improper Authentication

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

WordPress RegistrationMagic plugin < 6.0.9.9 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin RegistrationMagic versions 6.0.9.9...

CVE-2026-77794

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...

CVE-2026-77793

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...

CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...

CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...