Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 51 vulnerability records associated with RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login, published between 2017 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

51Total records
8Critical
11High
32Medium
0Low
0Informational
51Patched records
0Currently marked unpatched
2017-10-02First disclosure
2026-06-30Latest disclosure
49 of 51CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201733 records
202077 records
202122 records
202222 records
20231111 records
202499 records
202555 records
20261212 records

Severity Breakdown

SeverityRecordsShare
Critical815.7%
High1121.6%
Medium3262.7%

Vulnerability-Type Breakdown

Missing Authorization

14 records27.5%

First: 2020. Latest: 2026.

Cross-Site Scripting

12 records23.5%

First: 2017. Latest: 2025.

SQL Injection

7 records13.7%

First: 2017. Latest: 2025.

CSRF

7 records13.7%

First: 2020. Latest: 2026.

Other

4 records7.8%

First: 2017. Latest: 2026.

Authentication Bypass

4 records7.8%

First: 2021. Latest: 2026.

Privilege Escalation

2 records3.9%

First: 2024. Latest: 2026.

Information Disclosure

1 record2%

First: 2026. Latest: 2026.

Patch Status

Patched
51
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 6.0.9.2
  • 6.0.8.7
  • 6.0.7.7
  • 6.0.7.0
  • 6.0.7.5
  • 6.0.7.2
  • 6.0.6.8
  • 6.0.6.3
  • 6.0.4.4
  • 6.0.2.1
  • 6.0.3.4
  • 6.0.2.7
  • 6.0.1.1
  • 6.0.0.2
  • 5.3.2.1
  • 5.3.2.0
  • 5.3.1.0
  • 5.2.6.0
  • 5.2.5.1
  • 5.2.4.6
  • 5.2.3.1
  • 5.2.3.0
  • 5.2.4.2
  • 5.2.1.1
  • 5.2.1.0
  • 5.1.9.3
  • 5.0.2.2
  • 5.0.1.6
  • 5.0.1.9
  • 5.0.1.8
  • 4.6.0.4
  • 4.6.0.3
  • 3.8.0.9
  • 3.7.9.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-6.0.9.1RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' ParameterJune 30, 20266.0.9.2High
*-6.0.8.6RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN RequestJune 26, 20266.0.8.7Medium
*-6.0.8.6RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing AuthorizationJune 4, 20266.0.8.7Medium
*-6.0.7.6RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing AuthorizationMarch 20, 20266.0.7.7Medium
*-6.0.7.1RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication BypassMarch 12, 20266.0.7.2Critical
*-6.0.7.6RegistrationMagic <= 6.0.7.6 - Missing AuthorizationFebruary 18, 20266.0.7.7Medium
*-6.0.6.9RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_paymentFebruary 17, 20266.0.7.0Medium
[*, 6.0.7.2)RegistrationMagic < 6.0.7.2 - Missing AuthorizationFebruary 16, 20266.0.7.2Medium
*-6.0.7.4RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings ModificationJanuary 27, 20266.0.7.5Medium
*-6.0.7.1RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information ExposureJanuary 23, 20266.0.7.2Medium
*-6.0.7.1RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_orderJanuary 16, 20266.0.7.2Critical
*-6.0.6.9RegistrationMagic <= 6.0.6.9 - Cross-Site Request ForgeryJanuary 10, 20266.0.7.0Medium
*-6.0.6.7RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' ShortcodeDecember 15, 20256.0.6.8Medium
*-6.0.6.2RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL InjectionOctober 7, 20256.0.6.3High
*-6.0.4.3RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingApril 2, 20256.0.4.4Medium
*-6.0.2RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site ScriptingMarch 3, 20256.0.2.1Medium
*-6.0.3.3RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.3.3 - Reflected Cross-Site ScriptingJanuary 28, 20256.0.3.4Medium
*-6.0.2.6RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password RecoveryNovember 8, 20246.0.2.7Critical
*-6.0.1.0RegistrationMagic <= 6.0.1.0 - Unauthenticated Stored Cross-Site ScriptingAugust 16, 20246.0.1.1High
*-6.0.0.1RegistrationMagic <= 6.0.0.1 - Unauthenticated Stored Cross-Site ScriptingAugust 1, 20246.0.0.2High
*-5.3.2.0RegistrationMagic <= 5.3.2.0 - Reflected Cross-Site ScriptingApril 30, 20245.3.2.1Medium
*-5.3.0.0RegistrationMagic <= 5.3.0.0 - Cross-Site Request ForgeryMarch 26, 20245.3.1.0Medium
*-5.3.1.0RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via ShortcodeMarch 26, 20245.3.2.0High
*-5.2.5.9RegistrationMagic <= 5.2.5.9 - Reflected Cross-Site ScriptingMarch 16, 20245.2.6.0Medium
*-5.3.0.0RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege EscalationMarch 14, 20245.3.1.0High

Selected source records

Latest Records

HighCVE-2026-12158

RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter

Published: June 30, 2026

Affected versions
*-6.0.9.1
Patched versions
6.0.9.2
Original Wordfence record
MediumCVE-2026-9242

RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request

Published: June 26, 2026

Affected versions
*-6.0.8.6
Patched versions
6.0.8.7
Original Wordfence record
MediumCVE-2026-49764

RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization

Published: June 4, 2026

Affected versions
*-6.0.8.6
Patched versions
6.0.8.7
Original Wordfence record
MediumCVE-2026-32498

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization

Published: March 20, 2026

Affected versions
*-6.0.7.6
Patched versions
6.0.7.7
Original Wordfence record
CriticalCVE-2026-24373

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass

Published: March 12, 2026

Affected versions
*-6.0.7.1
Patched versions
6.0.7.2
Original Wordfence record
MediumCVE-2026-32385

RegistrationMagic <= 6.0.7.6 - Missing Authorization

Published: February 18, 2026

Affected versions
*-6.0.7.6
Patched versions
6.0.7.7
Original Wordfence record
MediumCVE-2025-14444

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment

Published: February 17, 2026

Affected versions
*-6.0.6.9
Patched versions
6.0.7.0
Original Wordfence record
MediumCVE-2026-0929

RegistrationMagic < 6.0.7.2 - Missing Authorization

Published: February 16, 2026

Affected versions
[*, 6.0.7.2)
Patched versions
6.0.7.2
Original Wordfence record

Highest-Severity Records

CriticalCVE-2020-9456

RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege Escalation

Published: March 5, 2020

Affected versions
[*, 4.6.0.4)
Patched versions
4.6.0.4
Original Wordfence record
CriticalCVE-2020-9457

RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation

Published: March 5, 2020

Affected versions
*-4.6.0.3
Patched versions
4.6.0.4
Original Wordfence record
CriticalCVE-2025-15403

RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

Published: January 16, 2026

Affected versions
*-6.0.7.1
Patched versions
6.0.7.2
Original Wordfence record
CriticalCVE-2023-2499

RegistrationMagic <= 5.2.1.0 - Authentication Bypass

Published: May 15, 2023

Affected versions
*-5.2.1.0
Patched versions
5.2.1.1
Original Wordfence record
CriticalCVE-2017-20208

RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection

Published: October 2, 2017

Affected versions
[*, 3.7.9.3)
Patched versions
3.7.9.3
Original Wordfence record
CriticalCVE-2024-10508

RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

Published: November 8, 2024

Affected versions
*-6.0.2.6
Patched versions
6.0.2.7
Original Wordfence record
CriticalCVE-2026-24373

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass

Published: March 12, 2026

Affected versions
*-6.0.7.1
Patched versions
6.0.7.2
Original Wordfence record
CriticalCVE-2021-4073

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

Published: December 8, 2021

Affected versions
*-5.0.1.7
Patched versions
5.0.1.8
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory