WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection

WordPress RegistrationMagic plugin before 5.0.1.6 contains an authenticated SQL injection vulnerability. The plugin does not escape user input in its rmchronosajax AJAX action before using it in a SQL statement when duplicating tasks in batches. An attacker can possibly obtain sensitive...

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...

RegistrationMagic <= 6.0.7.1 - Privilege Escalation

RegistrationMagic WordPress plugin = 6.0.7.1 contains a privilege escalation caused by improper access control in 'addmenu' via 'rmuserexists' AJAX action, letting unauthenticated attackers manipulate admin menu capabilities, exploit requires subscriber user for further escalation. id:...

CVE-2024-10508

RegistrationMagic = 6.0.2.6에서 비밀번호 복구를 통한 인증되지 않은 권한 상승 면책 조항 : 이 정보는 교육 목적으로만 제공됩니다. 이 문서는 보안 취약점에 대한 인식을 높이기 위한 것이며, 무단 또는 악의적인 활동에 사용되어서는 안 됩니다. 허가 없이 이러한 취약점을 악용하는 것은 불법이자 비윤리적입니다. WordPress용 RegistrationMagic – 사용자 등록 플러그인커스텀 등록 폼 포함은 버전 6.0.2.6까지의 모든 버전에서 계정 탈취를 통한 권한 상승 취약점에 노출되어 있습니다. 이는...

CVE-2026-82221-PoC

CVE-2026-82221 - RegistrationMagic의 인증되지 않은 반사형 XSS 개요 이 저장소는 RegistrationMagic WordPress 플러그인에서 발견된 인증되지 않은 반사형 크로스 사이트 스크립팅XSS 취약점인 CVE-2026-82221 에 대한 개념 증명PoC을 포함합니다. 이 취약점은 RegistrationMagic 제출 페이지의 activetab 매개변수에 영향을 미칩니다. 공격자는 JavaScript를 포함한 악성 URL을 제작하여 RegistrationMagic 제출물에 접근 권한이 있는...

CVE-2025-15403

CVE-2025-15403 RegistrationMagic 📡 The intel drops here first. Follow @KNxploited on Telegram — precision CVE disclosures, working exploits, and deep-dive vulnerability research. The channel for those who don't wait for the news — they make it. 🧠 Overview CVE-2025-15403 is a CVSS 9.8 Critical...

CVE-2024-10508

CVE-2024-10508 This tool scans WordPress sites for vulnerabilities in the RegistrationMagic plugin CVE-2024-10508. It checks for the presence of a specific version 6.0.2.6 and marks the site as vulnerable if found. The results are saved in a file vuln.txt for further analysis. Features: Scans...

WordPress RegistrationMagic plugin < 6.0.9.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Charles Vosburgh in WordPress Plugin RegistrationMagic versions 6.0.9.9...

CVE-2026-77826

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

EUVD-2026-71848

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

CVE-2026-77826

The RegistrationMagic WordPress plugin, in versions prior to 6.0.9.9 (specifically 5.0.1.8 through 6.0.9.8 ), is vulnerable to an unauthenticated authentication bypass . The root cause is a failure to validate the audience of a Facebook access token , meaning the plugin does not verify which appl...

CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

CVE-2026-77826 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

PT-2026-86330

🚨 CVE-2026-77826 The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and l...

CVE-2026-77826: Improper Authentication

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

WordPress RegistrationMagic plugin < 6.0.9.9 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin RegistrationMagic versions 6.0.9.9...

CVE-2026-77794

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...

CVE-2026-77793

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account...

CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...

CVE-2026-77794 RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants...