CVE-2026-77790: RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter

Q: Who can exploit this issue?

The issue requires a high-privilege WordPress user, such as an administrator. The available information does not indicate that unauthenticated or low-privilege users can exploit it.

Q: Which plugin versions are affected?

RegistrationMagic versions before 6.0.9.4 are affected. Updating to version 6.0.9.4 or later addresses the affected version range described.

Q: What input is involved in the SQL injection?

The vulnerable input is the rm_sortby parameter. It is used in a SQL statement without being sanitised and escaped.

Published Aug 26, 2026

Updated

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

Affected Software

1 affected component

RegistrationMagic WordPress plugin<6.0.9.4

Event History

Aug 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue requires a high-privilege WordPress user, such as an administrator. The available information does not indicate that unauthenticated or low-privilege users can exploit it.

Which plugin versions are affected?

RegistrationMagic versions before 6.0.9.4 are affected. Updating to version 6.0.9.4 or later addresses the affected version range described.

What input is involved in the SQL injection?

The vulnerable input is the rm_sortby parameter. It is used in a SQL statement without being sanitised and escaped.