CVE-2024-10508

RegistrationMagic = 6.0.2.6 のパスワード復旧機能を介した未認証の権限昇格 免責事項 : この情報は教育目的のみで提供されています。この文書はセキュリティ上の脆弱性についての認識を高めることを目的としており、許可のない活動や悪意のある活動に使用すべきではありません。許可なくこれらの脆弱性を悪用する行為は違法であり、非倫理的です。 WordPress 用プラグイン RegistrationMagic – User Registration Plugin with Custom Registration Forms は、バージョン 6.0.2.6...

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...

RegistrationMagic <= 6.0.7.1 - Privilege Escalation

RegistrationMagic WordPress plugin = 6.0.7.1 contains a privilege escalation caused by improper access control in 'addmenu' via 'rmuserexists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation. id:...

WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection

WordPress RegistrationMagic plugin before 5.0.1.6 contains an authenticated SQL injection vulnerability. The plugin does not escape user input in its rmchronosajax AJAX action before using it in a SQL statement when duplicating tasks in batches. An attacker can possibly obtain sensitive...

CVE-2026-82221-PoC

CVE-2026-82221 - 未认证反射型XSS漏洞（RegistrationMagic） 概述 本仓库包含 CVE-2026-82221 的概念验证（PoC），该漏洞是在 RegistrationMagic WordPress 插件中发现的一个未认证反射型跨站脚本（XSS）漏洞。 该漏洞影响 RegistrationMagic 提交页面上的 activetab 参数。 攻击者可以构造包含 JavaScript 的恶意 URL，并将其发送给有权访问 RegistrationMagic 提交内容的受害者。当受害者打开该构造的 URL 时，攻击者控制的 JavaScript 将在易受攻击...

CVE-2025-15403

CVE-2025-15403 RegistrationMagic 📡 インテルは最初にここで公開される。 Telegram で @KNxploited をフォロー — 正確な CVE 公開、動作するエクスプロイト、詳細な脆弱性研究。 ニュースを待たない人のためのチャンネル — 彼らがニュースを創る。 🧠 概要 CVE-2025-15403 は、WordPress 用プラグイン RegistrationMagic における CVSS 9.8 Critical の権限昇格（Privilege Escalation）脆弱性です。 この欠陥はプラグインの addmenu...

CVE-2024-10508

CVE-2024-10508 このツールは、WordPressサイトをスキャンしてRegistrationMagic プラグインの脆弱性CVE-2024-10508 を検出します。 特定のバージョン（6.0.2.6）が存在するかどうかを確認し、存在する場合はそのサイトを脆弱としてマークします。 結果は、さらなる分析のためにファイル（vuln.txt）に保存されます。 特徴: WordPressサイトをスキャンして「RegistrationMagic」プラグインの脆弱性、特にCVE-2024-10508を検出します。...

WordPress RegistrationMagic plugin < 6.0.9.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Charles Vosburgh in WordPress Plugin RegistrationMagic versions 6.0.9.9...

CVE-2026-77826

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

EUVD-2026-71848

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

CVE-2026-77826

The RegistrationMagic WordPress plugin, in versions prior to 6.0.9.9 (specifically 5.0.1.8 through 6.0.9.8 ), is vulnerable to an unauthenticated authentication bypass . The root cause is a failure to validate the audience of a Facebook access token , meaning the plugin does not verify which appl...

CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

PT-2026-86330

🚨 CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and l...

CVE-2026-77826: Improper Authentication

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

WordPress RegistrationMagic plugin < 6.0.9.9 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin RegistrationMagic versions 6.0.9.9...

CVE-2026-77794

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...

CVE-2026-77793

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...

CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...

CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...