WordPress Plugin Vulnerabilities

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.9 - Authentication Bypass

Description

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9.8. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, which may be administrators.

Affects Plugins

Plugin icon
custom-registration-form-builder-with-submission-manager
Fixed in 6.0.9.9

References

CVE
CVE-2026-82225
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7c813654-de1f-40e8-a970-c61850adf933

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
7.3 (high)

Miscellaneous

Original Researcher
emiliano carrizo
Verified
No
WPVDB ID
b305ee08-fd69-4a1c-9ef1-a12788e3430b

Timeline

Publicly Published
2026-08-28 (about 23 days ago)
Added
2026-09-02 (about 17 days ago)
Last Updated
2026-09-02 (about 17 days ago)

Other

Published
Title
Published
2014-08-01
Title
G-Lock Double Opt-in Manager - Two Security Bypass Vulnerabilities
Published
2026-09-09
Title
WC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified Webhook
Published
2016-07-03
Title
Advanced Ajax Page Loader < 2.7.7 - Unauthenticated Uploaded File Disclosure
Published
2026-07-10
Title
Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution
Published
2025-08-22
Title
Case Theme User < 1.0.4 - Authentication Bypass via Social Login