Extension WordPress
Vulnérabilités RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Cette page rassemble les failles publiées pour RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
55 fiches
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 – Unauthenticated PHP Object Injection
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.0.9.7. This is due to deserialization of untrusted input. This…
*-6.0.9.7
6.0.9.8
18/08/2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 – Missing Authorization
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 6.0.9.4. This makes it possible…
[*, 6.0.9.4)
6.0.9.4
30/07/2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 – Unauthenticated Insecure Direct Object Reference
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to 6.0.9.4 due to missing validation on a user controlled key. This makes…
[*, 6.0.9.4)
6.0.9.4
30/07/2026
RegistrationMagic <= 6.0.9.4 – Unauthenticated Price Manipulation
The RegistrationMagic plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 6.0.9.4. This is due to a lack of server-side verification of the captured payment amount, currency, invoice ID, and custom payment key…
*-6.0.9.4
6.0.9.5
20/07/2026
RegistrationMagic <= 6.0.9.1 – Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This…
*-6.0.9.1
6.0.9.2
30/06/2026
RegistrationMagic <= 6.0.8.6 – Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to…
*-6.0.8.6
6.0.8.7
26/06/2026
RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 – Missing Authorization
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.0.8.6. This makes it possible for unauthenticated…
*-6.0.8.6
6.0.8.7
04/06/2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 – Missing Authorization
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.0.7.6. This…
*-6.0.7.6
6.0.7.7
20/03/2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 – Authentication Bypass
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.7.1. This makes it possible for unauthenticated attackers to bypass authentication.
*-6.0.7.1
6.0.7.2
12/03/2026
RegistrationMagic <= 6.0.7.6 – Missing Authorization
The RegistrationMagic plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.0.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above,…
*-6.0.7.6
6.0.7.7
18/02/2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 – Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including,…
*-6.0.6.9
6.0.7.0
17/02/2026
RegistrationMagic < 6.0.7.2 – Missing Authorization
The RegistrationMagic plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 6.0.7.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform…
[*, 6.0.7.2)
6.0.7.2
16/02/2026
RegistrationMagic <= 6.0.7.4 – Missing Authorization to Unauthenticated Arbitrary Settings Modification
The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for…
*-6.0.7.4
6.0.7.5
27/01/2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 – Authenticated (Subscriber+) Information Exposure
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.7.1. This makes it possible for authenticated attackers, with Subscriber-level…
*-6.0.7.1
6.0.7.2
23/01/2026
RegistrationMagic <= 6.0.7.1 – Unauthenticated Privilege Escalation via admin_order
The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the…
*-6.0.7.1
6.0.7.2
16/01/2026
RegistrationMagic <= 6.0.6.9 – Cross-Site Request Forgery
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.6.9. This is due to missing or incorrect nonce validation…
*-6.0.6.9
6.0.7.0
10/01/2026
RegistrationMagic <= 6.0.6.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input…
*-6.0.6.7
6.0.6.8
15/12/2025
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 – Authenticated (Administrator+) SQL Injection
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and…
*-6.0.6.2
6.0.6.3
07/10/2025
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization…
*-6.0.4.3
6.0.4.4
02/04/2025
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.2 – Authenticated (Admin+) Stored Cross-Site Scripting
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.0.2 due to insufficient input sanitization and…
*-6.0.2
6.0.2.1
03/03/2025
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.