The RegistrationMagic WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) due to improper neutralization of special elements in SQL commands. Authenticated attackers with administrator-level access can inject additional SQL queries to extract sensitive database information. The vulnerability also includes a vector for unauthenticated attackers to perform reflected Cross-Site Scripting via the user-agent header during form submission. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, required high privileges, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows attackers with administrator privileges to execute arbitrary SQL commands, potentially leading to unauthorized data disclosure, data modification, or denial of service. The reflected XSS component could enable attackers to execute malicious scripts in the context of users' browsers, potentially leading to session hijacking or other client-side attacks. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity. Avoid exposing the vulnerable plugin on publicly accessible sites if possible. Do not rely on generic mitigations; await vendor-provided patches or official workarounds.