CVE-2026-77790: Unknown Registrationmagic

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

Affected products

• Unknown Registrationmagic: before 6.0.9.4 (fixed in 6.0.9.4)

Published 2026-08-26. Last modified 2026-09-03.