CVE-2026-110984: RegistrationMagic < 6.1.0.4 - Admin+ SQLi via 'rm_fromdate' and 'rm_dateupto' Parameters

Q: Who can exploit this issue?

Exploitation requires a high-privilege WordPress user, such as an administrator. It is therefore primarily relevant where administrator accounts could be compromised or misused.

Q: Which inputs are involved?

The affected parameters are rm_fromdate and rm_dateupto. They are used in a SQL statement without appropriate sanitization and escaping in versions before 6.1.0.4.

Q: Are installations running the fixed version affected?

No. The issue affects RegistrationMagic versions before 6.1.0.4; upgrading to version 6.1.0.4 or later addresses the affected version range.

Published Nov 15, 2026

Updated

The RegistrationMagic WordPress plugin before 6.1.0.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

Affected Software

1 affected component

RegistrationMagic RegistrationMagic<6.1.0.4

Event History

Nov 15, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires a high-privilege WordPress user, such as an administrator. It is therefore primarily relevant where administrator accounts could be compromised or misused.

Which inputs are involved?

The affected parameters are rm_fromdate and rm_dateupto. They are used in a SQL statement without appropriate sanitization and escaping in versions before 6.1.0.4.

Are installations running the fixed version affected?

No. The issue affects RegistrationMagic versions before 6.1.0.4; upgrading to version 6.1.0.4 or later addresses the affected version range.

CVE-2026-110984: RegistrationMagic < 6.1.0.4 - Admin+ SQLi via 'rm_fromdate' and 'rm_dateupto' Parameters

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which inputs are involved?

Are installations running the fixed version affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which inputs are involved?

Are installations running the fixed version affected?