RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

Software Type	Plugin
Software Slug	custom-registration-form-builder-with-submission-manager (view on wordpress.org)
Software Status	Active
Software Author	metagauss
Software Website	www.registrationmagic.com
Software Downloads	2,096,190
Software Active Installs	8,000
Software Record Last Updated	July 13, 2026

Showing 1-20 of 51 Vulnerabilities

Submit a Vulnerability

RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter

8.8

CVE-2026-12158

Jun 30, 2026

Researchers: Chloe Chamberland, PRISM

RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request

5.3

CVE-2026-9242

Jun 26, 2026

Researcher: Rafael Gunawan (kokon)

RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization

5.3

CVE-2026-49764

Jun 4, 2026

Researcher: James Paremain

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization

5.3

CVE-2026-32498

Mar 20, 2026

Researcher: Supakiad S. (m3ez)

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass

9.8

CVE-2026-24373

Mar 12, 2026

Researcher: 0xd4rk5id3

RegistrationMagic <= 6.0.7.6 - Missing Authorization

4.3

CVE-2026-32385

Feb 18, 2026

Researcher: Supakiad S. (m3ez)

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment

5.3

CVE-2025-14444

Feb 17, 2026

Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)

RegistrationMagic < 6.0.7.2 - Missing Authorization

4.3

CVE-2026-0929

Feb 16, 2026

Researcher: Maktoum (bRpsd)

RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification

5.3

CVE-2026-1054

Jan 27, 2026

Researcher: Md. Moniruzzaman Prodhan (NomanProdhan)

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure

5.3

CVE-2025-15520

Jan 23, 2026

Researcher: Maktoum (bRpsd)

RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

9.8

CVE-2025-15403

Jan 16, 2026

Researcher: Osvaldo Noe Gonzalez Del Rio (Os)

RegistrationMagic <= 6.0.6.9 - Cross-Site Request Forgery

4.3

CVE-2026-24374

Jan 10, 2026

Researcher: 0xd4rk5id3

RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode

6.4

CVE-2025-13610

Dec 15, 2025

Researcher: Muhammad Yudha - DJ

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection

7.2

CVE-2025-11204

Oct 7, 2025

Researcher: ifoundbug

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

6.4

CVE-2025-2836

Apr 2, 2025

Researcher: Brian Sans-Souci (liardom)

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4

CVE-2024-9390

Mar 3, 2025

Researcher: Krugov Artyom

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.3.3 - Reflected Cross-Site Scripting

6.1

CVE-2025-24686

Jan 28, 2025

Researcher: 0xd4rk5id3

RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

9.8

CVE-2024-10508

Nov 8, 2024

Researcher: shaman0x01

RegistrationMagic <= 6.0.1.0 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-43317

Aug 16, 2024

Researcher: SOPROBRO

RegistrationMagic <= 6.0.0.1 - Unauthenticated Stored Cross-Site Scripting

7.2

CVE-2024-39643

Aug 1, 2024

Researcher: LVT-tholv2k

Title	Status	CVE ID	CVSS	Researchers	Date
RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter	Patched	CVE-2026-12158	8.8	Chloe Chamberland, PRISM	June 30, 2026
RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request	Patched	CVE-2026-9242	5.3	Rafael Gunawan (kokon)	June 26, 2026
RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization	Patched	CVE-2026-49764	5.3	James Paremain	June 4, 2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization	Patched	CVE-2026-32498	5.3	Supakiad S. (m3ez)	March 20, 2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass	Patched	CVE-2026-24373	9.8	0xd4rk5id3	March 12, 2026
RegistrationMagic <= 6.0.7.6 - Missing Authorization	Patched	CVE-2026-32385	4.3	Supakiad S. (m3ez)	February 18, 2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment	Patched	CVE-2025-14444	5.3	Md. Moniruzzaman Prodhan (NomanProdhan)	February 17, 2026
RegistrationMagic < 6.0.7.2 - Missing Authorization	Patched	CVE-2026-0929	4.3	Maktoum (bRpsd)	February 16, 2026
RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification	Patched	CVE-2026-1054	5.3	Md. Moniruzzaman Prodhan (NomanProdhan)	January 27, 2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure	Patched	CVE-2025-15520	5.3	Maktoum (bRpsd)	January 23, 2026
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order	Patched	CVE-2025-15403	9.8	Osvaldo Noe Gonzalez Del Rio (Os)	January 16, 2026
RegistrationMagic <= 6.0.6.9 - Cross-Site Request Forgery	Patched	CVE-2026-24374	4.3	0xd4rk5id3	January 10, 2026
RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode	Patched	CVE-2025-13610	6.4	Muhammad Yudha - DJ	December 15, 2025
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection	Patched	CVE-2025-11204	7.2	ifoundbug	October 7, 2025
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting	Patched	CVE-2025-2836	6.4	Brian Sans-Souci (liardom)	April 2, 2025
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting	Patched	CVE-2024-9390	4.4	Krugov Artyom	March 3, 2025
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.3.3 - Reflected Cross-Site Scripting	Patched	CVE-2025-24686	6.1	0xd4rk5id3	January 28, 2025
RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery	Patched	CVE-2024-10508	9.8	shaman0x01	November 8, 2024
RegistrationMagic <= 6.0.1.0 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2024-43317	7.2	SOPROBRO	August 16, 2024
RegistrationMagic <= 6.0.0.1 - Unauthenticated Stored Cross-Site Scripting	Patched	CVE-2024-39643	7.2	LVT-tholv2k	August 1, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation