VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 48 known issues Latest disclosed Mar 20, 2026

RegistrationMagic – User Registration Forms Plugin Vulnerabilities

Review known vulnerability records for the WordPress plugin RegistrationMagic – User Registration Forms Plugin (`custom-registration-form-builder-with-submission-manager`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-32498, CVE-2026-24373 and CVE-2026-32385, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
48
High or Critical
18
Patch Coverage
100%
Last Updated
May 04, 2026
Related Security Guides

Use these guides while reviewing RegistrationMagic – User Registration Forms Plugin fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize RegistrationMagic – User Registration Forms Plugin remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
43
1. Match the Package
Confirm the installed WordPress plugin slug is custom-registration-form-builder-with-submission-manager before acting on any CVE from this cluster.
2. Sort by Severity
Start with 18 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
48 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2020-9457 Critical
Privilege Escalation remediation for RegistrationMagic – User Registration Forms Plugin

Affected range: Versions up to 4.6.0.3. Fixed version: 4.6.0.4.

CVE-2020-9456 Critical
Privilege Escalation remediation for RegistrationMagic – User Registration Forms Plugin

Affected range: Versions before 4.6.0.4. Fixed version: 4.6.0.4.

CVE-2026-24373 Critical
Vulnerability remediation for RegistrationMagic – User Registration Forms Plugin

Affected range: Versions up to 6.0.7.1. Fixed version: 6.0.7.2.

CVE-2025-15403 Critical
Privilege Escalation remediation for RegistrationMagic – User Registration Forms Plugin

Affected range: Versions up to 6.0.7.1. Fixed version: 6.0.7.2.

Priority CVE Quick Links

Fast paths into RegistrationMagic – User Registration Forms Plugin CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
46
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2020-9457
RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authentica...
 Privilege Escalation Versions up to 4.6.0.3 4.6.0.4 CVSS 9.9
CVE-2020-9456
RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authentica...
 Privilege Escalation Versions before 4.6.0.4 4.6.0.4 CVSS 9.9
CVE-2026-24373
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User...
 Vulnerability Versions up to 6.0.7.1 6.0.7.2 CVSS 9.8
CVE-2025-15403
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
 Privilege Escalation Versions up to 6.0.7.1 6.0.7.2 CVSS 9.8
CVE-2024-10508
RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2...
 Privilege Escalation Versions up to 6.0.2.6 6.0.2.7 CVSS 9.8
CVE-2023-2499
RegistrationMagic <= 5.2.1.0 - Authentication Bypass
 Vulnerability Versions up to 5.2.1.0 5.2.1.1 CVSS 9.8
CVE-2021-4073
RegistrationMagic <= 5.0.1.7 - Authentication Bypass
 Vulnerability Versions up to 5.0.1.7 5.0.1.8 CVSS 9.8
CVE-2017-20208
RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
 Vulnerability Versions before 3.7.9.3 3.7.9.3 CVSS 9.8
CVE-2020-9457 Critical 4.6.0.4
CVE-2020-9457 RegistrationMagic – User Registration Forms Plugin Privilege Escalation

RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation

CVE-2020-9456 Critical 4.6.0.4
CVE-2020-9456 RegistrationMagic – User Registration Forms Plugin Privilege Escalation

RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege Escalation

CVE-2026-24373 Critical 6.0.7.2
CVE-2026-24373 RegistrationMagic – User Registration Forms Plugin Vulnerability

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass

CVE-2025-15403 Critical 6.0.7.2
CVE-2025-15403 RegistrationMagic – User Registration Forms Plugin Privilege Escalation

RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

CVE-2024-10508 Critical 6.0.2.7
CVE-2024-10508 RegistrationMagic – User Registration Forms Plugin Privilege Escalation

RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

CVE-2023-2499 Critical 5.2.1.1
CVE-2023-2499 RegistrationMagic – User Registration Forms Plugin Vulnerability

RegistrationMagic <= 5.2.1.0 - Authentication Bypass

CVE-2021-4073 Critical 5.0.1.8
CVE-2021-4073 RegistrationMagic – User Registration Forms Plugin Vulnerability

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

CVE-2017-20208 Critical 3.7.9.3
CVE-2017-20208 RegistrationMagic – User Registration Forms Plugin Vulnerability

RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for RegistrationMagic – User Registration Forms Plugin so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
48 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
8 critical and 10 high severity findings.
Recent CVEs
CVE-2026-32498, CVE-2026-24373 and CVE-2026-32385
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for RegistrationMagic – User Registration Forms Plugin

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-32498
CVE-2026-32498: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 6.0.7.6. This makes it possible for unauth...

Published
Mar 20, 2026
Patched Release
6.0.7.7
Affected Versions
Versions up to 6.0.7.6
Next Step
Update to 6.0.7.7 or newer if supported.
Review CVE-2026-32498 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2026-24373
CVE-2026-24373: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.7.1. This makes it possible for unauthenticated attackers to bypass authentication.

Published
Mar 12, 2026
Patched Release
6.0.7.2
Affected Versions
Versions up to 6.0.7.1
Next Step
Update to 6.0.7.2 or newer if supported.
Review CVE-2026-24373 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-32385
CVE-2026-32385: RegistrationMagic <= 6.0.7.6 - Missing Authorization

The RegistrationMagic plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.0.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an una...

Published
Feb 18, 2026
Patched Release
6.0.7.7
Affected Versions
Versions up to 6.0.7.6
Next Step
Update to 6.0.7.7 or newer if supported.
Review CVE-2026-32385 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-14444
CVE-2025-14444: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and includi...

Published
Feb 17, 2026
Patched Release
6.0.7.0
Affected Versions
Versions up to 6.0.6.9
Next Step
Update to 6.0.7.0 or newer if supported.
Review CVE-2025-14444 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-0929
CVE-2026-0929: RegistrationMagic < 6.0.7.2 - Missing Authorization

The RegistrationMagic plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 6.0.7.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action...

Published
Feb 16, 2026
Patched Release
6.0.7.2
Affected Versions
Versions before 6.0.7.2
Next Step
Update to 6.0.7.2 or newer if supported.
Review CVE-2026-0929 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-1054
CVE-2026-1054: RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification

The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes it possible for unauthenticated attackers...

Published
Jan 27, 2026
Patched Release
6.0.7.5
Affected Versions
Versions up to 6.0.7.4
Next Step
Update to 6.0.7.5 or newer if supported.
Review CVE-2026-1054 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-15520
CVE-2025-15520: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.7.1. This makes it possible for authenticated attackers, with Subscriber-le...

Published
Jan 23, 2026
Patched Release
6.0.7.2
Affected Versions
Versions up to 6.0.7.1
Next Step
Update to 6.0.7.2 or newer if supported.
Review CVE-2025-15520 fixed version details Open CVE Reference
Plugin Critical Patched: Yes CVE-2025-15403
CVE-2025-15403: RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admin_order' setting. Thi...

Published
Jan 16, 2026
Patched Release
6.0.7.2
Affected Versions
Versions up to 6.0.7.1
Next Step
Update to 6.0.7.2 or newer if supported.
Review CVE-2025-15403 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-24374
CVE-2026-24374: RegistrationMagic <= 6.0.6.9 - Cross-Site Request Forgery

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.6.9. This is due to missing or incorrect nonce validation on a function. This m...

Published
Jan 10, 2026
Patched Release
6.0.7.0
Affected Versions
Versions up to 6.0.6.9
Next Step
Update to 6.0.7.0 or newer if supported.
Review CVE-2026-24374 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-13610
CVE-2025-13610: RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'RM_Forms' shortcode in all versions up to, and including, 6.0.6.7 due to insufficient input sanitizati...

Published
Dec 15, 2025
Patched Release
6.0.6.8
Affected Versions
Versions up to 6.0.6.7
Next Step
Update to 6.0.6.8 or newer if supported.
Review CVE-2025-13610 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-11204
CVE-2025-11204: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa...

Published
Oct 07, 2025
Patched Release
6.0.6.3
Affected Versions
Versions up to 6.0.6.2
Next Step
Update to 6.0.6.3 or newer if supported.
Review CVE-2025-11204 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2836
CVE-2025-2836: RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘payment_method’ parameter in all versions up to, and including, 6.0.4.3 due to insufficient input sanitization...

Published
Apr 02, 2025
Patched Release
6.0.4.4
Affected Versions
Versions up to 6.0.4.3
Next Step
Update to 6.0.4.4 or newer if supported.
Review CVE-2025-2836 fixed version details Open CVE Reference