CVE-2025-11204: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11204?
CVE-2025-11204 is classified as a high severity vulnerability due to its potential for SQL Injection, which can allow attackers to access sensitive data.
How do I fix CVE-2025-11204?
To fix CVE-2025-11204, update the RegistrationMagic plugin to version 6.0.6.3 or later, which addresses the SQL Injection vulnerability.
What versions of RegistrationMagic are affected by CVE-2025-11204?
CVE-2025-11204 affects all versions of the RegistrationMagic plugin up to and including 6.0.6.2.
What kind of data could be compromised due to CVE-2025-11204?
CVE-2025-11204 could lead to unauthorized access to user data, including registration details and payment information.
Is CVE-2025-11204 limited to certain configurations of WordPress?
CVE-2025-11204 affects any installation of WordPress using the vulnerable versions of the RegistrationMagic plugin, regardless of specific configurations.