SQL Injection Vulnerability in RegistrationMagic Plugin for WordPress
CVE-2025-11204

7.2HIGH

Key Information:

Vendor

WordPress
Status
Registrationmagic – Custom Registration Forms, User Registration, Payment, And User Login
Vendor
CVE Published:
8 October 2025

What is CVE-2025-11204?

The RegistrationMagic plugin for WordPress is vulnerable to SQL Injection due to inadequate escaping of user-supplied parameters and poorly constructed SQL queries. This exposes authenticated users with administrator privileges to the risk of appending malicious SQL queries, potentially leading to the extraction of sensitive database information. Additionally, an unauthenticated attacker may exploit this vulnerability through Cross-Site Scripting using the user-agent during form submission, allowing for the possibility of reflected XSS attacks.

Affected Version(s)

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login * <= 6.0.6.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/custom-registr...
https://wordpress.org/plugins/custom-registration-form-bu...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ifoundbug
JSON
.