SQL Injection Vulnerability in RegistrationMagic Plugin for WordPress
CVE-2025-11204
7.2HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 October 2025
What is CVE-2025-11204?
The RegistrationMagic plugin for WordPress is vulnerable to SQL Injection due to inadequate escaping of user-supplied parameters and poorly constructed SQL queries. This exposes authenticated users with administrator privileges to the risk of appending malicious SQL queries, potentially leading to the extraction of sensitive database information. Additionally, an unauthenticated attacker may exploit this vulnerability through Cross-Site Scripting using the user-agent during form submission, allowing for the possibility of reflected XSS attacks.
Affected Version(s)
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login * <= 6.0.6.2