CVE-2026-77790: CWE-89 SQL Injection in RegistrationMagic

The RegistrationMagic WordPress plugin versions prior to 6.0.9.4 do not sanitize and escape a parameter before incorporating it into a SQL query. This flaw allows users with high privileges (e.g., admin) to conduct SQL injection attacks, potentially leading to partial compromise of confidentiality and integrity of the database. The vulnerability is tracked as CVE-2026-77790 and is categorized under CWE-89 (SQL Injection). No official patch or remediation level has been confirmed in the provided data.

Successful exploitation could allow a high privilege user to execute arbitrary SQL commands within the database context of the plugin, potentially leading to unauthorized data disclosure and modification. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access to trusted personnel only and monitor for suspicious activity related to SQL queries in the plugin. Avoid using vulnerable versions of the plugin if possible.