Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 51 vulnerability records associated with RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login, published between 2017 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

51Total records
8Critical
11High
32Medium
0Low
0Informational
51Patched records
0Currently marked unpatched
2017-10-02First disclosure
2026-06-30Latest disclosure
49 of 51CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201733 records
202077 records
202122 records
202222 records
20231111 records
202499 records
202555 records
20261212 records

Severity Breakdown

SeverityRecordsShare
Critical815.7%
High1121.6%
Medium3262.7%

Vulnerability-Type Breakdown

Missing Authorization

14 records27.5%

First: 2020. Latest: 2026.

Cross-Site Scripting

12 records23.5%

First: 2017. Latest: 2025.

SQL Injection

7 records13.7%

First: 2017. Latest: 2025.

CSRF

7 records13.7%

First: 2020. Latest: 2026.

Other

4 records7.8%

First: 2017. Latest: 2026.

Authentication Bypass

4 records7.8%

First: 2021. Latest: 2026.

Privilege Escalation

2 records3.9%

First: 2024. Latest: 2026.

Information Disclosure

1 record2%

First: 2026. Latest: 2026.

Patch Status

Patched
51
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 6.0.9.2
  • 6.0.8.7
  • 6.0.7.7
  • 6.0.7.0
  • 6.0.7.5
  • 6.0.7.2
  • 6.0.6.8
  • 6.0.6.3
  • 6.0.4.4
  • 6.0.2.1
  • 6.0.3.4
  • 6.0.2.7
  • 6.0.1.1
  • 6.0.0.2
  • 5.3.2.1
  • 5.3.2.0
  • 5.3.1.0
  • 5.2.6.0
  • 5.2.5.1
  • 5.2.4.6
  • 5.2.3.1
  • 5.2.3.0
  • 5.2.4.2
  • 5.2.1.1
  • 5.2.1.0
  • 5.1.9.3
  • 5.0.2.2
  • 5.0.1.6
  • 5.0.1.9
  • 5.0.1.8
  • 4.6.0.4
  • 4.6.0.3
  • 3.8.0.9
  • 3.7.9.3

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-5.2.5.9RegistrationMagic <= 5.2.5.9 - Cross-Site Request ForgeryFebruary 20, 20245.2.6.0Medium
*-5.2.5.0RegistrationMagic <= 5.2.5.0 - Form Submission Limit BypassDecember 27, 20235.2.5.1Medium
*-5.2.5.0RegistrationMagic <= 5.2.5.0 - IP SpoofingDecember 27, 20235.2.5.1Medium
[*, 5.2.4.6)RegistrationMagic Plugin <= 5.2.4.5 - Authenticated(Administrator+) SQL InjectionDecember 21, 20235.2.4.6Medium
*-5.2.3.0RegistrationMagic <= 5.2.3.0 - Missing AuthorizationDecember 5, 20235.2.3.1Medium
*-5.2.2.6RegistrationMagic <= 5.2.2.6 - Cross-Site Request ForgeryNovember 27, 20235.2.3.0Medium
[*, 5.2.4.2)RegistrationMagic <= 5.2.4.1 - Reflected Cross-Site Scripting via section_idOctober 7, 20235.2.4.2Medium
*-5.2.1.0RegistrationMagic <= 5.2.1.0 - Authentication BypassMay 15, 20235.2.1.1Critical
*-5.2.0.5RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password ChangeMay 12, 20235.2.1.0Medium
*-5.1.9.2RegistrationMagic <= 5.1.9.2 - Cross-Site Request Forgery leading to Form Metadata DeletionFebruary 17, 20235.1.9.3Medium
*-5.1.9.2RegistrationMagic <= 5.1.9.2 - Improper Authorization to Price ChangeJanuary 20, 20235.1.9.3Medium
*-5.1.9.2RegistrationMagic <= 5.1.9.2 - Missing Authorization to Unauthenticated Content InjectionJanuary 20, 20235.1.9.3Medium
[*, 5.0.2.2)RegistrationMagic <= 5.0.2.1 - SQL InjectionFebruary 7, 20225.0.2.2High
*-5.0.1.5RegistrationMagic <= 5.0.1.5 - SQL InjectionJanuary 23, 20225.0.1.6High
*-5.0.1.8Registration Magic <= 5.0.1.8 - Reflected Cross-Site ScriptingDecember 28, 20215.0.1.9Medium
*-5.0.1.7RegistrationMagic <= 5.0.1.7 - Authentication BypassDecember 8, 20215.0.1.8Critical
*-4.6.0.3RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege EscalationMarch 5, 20204.6.0.4Critical
*-4.6.0.3RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Email InjectionMarch 5, 20204.6.0.4Medium
[*, 4.6.0.4)RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings and User Data ExportMarch 5, 20204.6.0.4Medium
[*, 4.6.0.4)RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege EscalationMarch 5, 20204.6.0.4Critical
[*, 4.6.0.4)RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Cross-Site Request Forgery to Settings ModificationMarch 5, 20204.6.0.4High
[*, 4.6.0.3)RegistrationMagic - Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL InjectionFebruary 13, 20204.6.0.3High
*-4.6.0.1RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.1 - Cross-Site ScriptingJanuary 30, 20204.6.0.3Medium
*-3.8.0.4RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - SQL InjectionDecember 10, 20173.8.0.9High
*-3.7.9.2RegistrationMagic - Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site ScriptingDecember 10, 20173.8.0.9Medium

Selected source records

Latest Records

HighCVE-2026-12158

RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter

Published: June 30, 2026

Affected versions
*-6.0.9.1
Patched versions
6.0.9.2
Original Wordfence record
MediumCVE-2026-9242

RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request

Published: June 26, 2026

Affected versions
*-6.0.8.6
Patched versions
6.0.8.7
Original Wordfence record
MediumCVE-2026-49764

RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization

Published: June 4, 2026

Affected versions
*-6.0.8.6
Patched versions
6.0.8.7
Original Wordfence record
MediumCVE-2026-32498

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization

Published: March 20, 2026

Affected versions
*-6.0.7.6
Patched versions
6.0.7.7
Original Wordfence record
CriticalCVE-2026-24373

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass

Published: March 12, 2026

Affected versions
*-6.0.7.1
Patched versions
6.0.7.2
Original Wordfence record
MediumCVE-2026-32385

RegistrationMagic <= 6.0.7.6 - Missing Authorization

Published: February 18, 2026

Affected versions
*-6.0.7.6
Patched versions
6.0.7.7
Original Wordfence record
MediumCVE-2025-14444

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment

Published: February 17, 2026

Affected versions
*-6.0.6.9
Patched versions
6.0.7.0
Original Wordfence record
MediumCVE-2026-0929

RegistrationMagic < 6.0.7.2 - Missing Authorization

Published: February 16, 2026

Affected versions
[*, 6.0.7.2)
Patched versions
6.0.7.2
Original Wordfence record

Highest-Severity Records

CriticalCVE-2020-9456

RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege Escalation

Published: March 5, 2020

Affected versions
[*, 4.6.0.4)
Patched versions
4.6.0.4
Original Wordfence record
CriticalCVE-2020-9457

RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation

Published: March 5, 2020

Affected versions
*-4.6.0.3
Patched versions
4.6.0.4
Original Wordfence record
CriticalCVE-2025-15403

RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

Published: January 16, 2026

Affected versions
*-6.0.7.1
Patched versions
6.0.7.2
Original Wordfence record
CriticalCVE-2023-2499

RegistrationMagic <= 5.2.1.0 - Authentication Bypass

Published: May 15, 2023

Affected versions
*-5.2.1.0
Patched versions
5.2.1.1
Original Wordfence record
CriticalCVE-2017-20208

RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection

Published: October 2, 2017

Affected versions
[*, 3.7.9.3)
Patched versions
3.7.9.3
Original Wordfence record
CriticalCVE-2024-10508

RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

Published: November 8, 2024

Affected versions
*-6.0.2.6
Patched versions
6.0.2.7
Original Wordfence record
CriticalCVE-2026-24373

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass

Published: March 12, 2026

Affected versions
*-6.0.7.1
Patched versions
6.0.7.2
Original Wordfence record
CriticalCVE-2021-4073

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

Published: December 8, 2021

Affected versions
*-5.0.1.7
Patched versions
5.0.1.8
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory