CVE-2025-11204: RegistrationMagic WordPress SQL Injection

CVE-2025-11204 Overview

CVE-2025-11204 is a SQL Injection vulnerability in the RegistrationMagic WordPress plugin, which provides custom registration forms, user registration, payment, and login functionality. The flaw affects all versions up to and including 6.0.6.2. The vulnerability stems from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries in class_rm_reports_service.php. Authenticated attackers with administrator-level access can append additional SQL queries to extract sensitive database information. An unauthenticated attacker can also leverage an injected Cross-Site Scripting payload via the User-Agent header on form submission to achieve Reflected XSS. The issue is tracked under CWE-89.

Critical Impact
Authenticated administrators can extract arbitrary data from the WordPress database, and unauthenticated attackers can trigger Reflected XSS through the User-Agent header on form submission.

Affected Products

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress
All plugin versions up to and including 6.0.6.2
WordPress sites using the vulnerable class_rm_reports_service.php component

Discovery Timeline

2025-10-08 - CVE-2025-11204 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11204

Vulnerability Analysis

The vulnerability is a SQL Injection flaw located within the reports service component (class_rm_reports_service.php) of the RegistrationMagic plugin. The plugin constructs SQL statements that include user-supplied input without adequate escaping or use of prepared statements. This allows an authenticated attacker with administrator privileges to append additional SQL clauses onto legitimate queries. The result is arbitrary data extraction from the underlying database, including user credentials, session tokens, and personally identifiable information stored by the plugin.

A secondary attack vector exists for unauthenticated actors. The plugin fails to sanitize the User-Agent header captured during form submission. An attacker can inject a JavaScript payload via this header, which the plugin later reflects into administrative report views, resulting in Reflected Cross-Site Scripting.

Root Cause

The root cause is twofold: missing input escaping on parameters flowing into SQL query construction, and absence of parameterized queries using $wpdb->prepare(). The plugin developers concatenated user input directly into SQL strings within the reports service class. Additionally, the User-Agent value stored during submission is emitted into HTML output without contextual encoding, producing the XSS sink.

Attack Vector

The SQL Injection path requires an authenticated session with administrator or higher privileges. Attackers submit crafted parameters to endpoints handled by the reports service. The XSS path is network-reachable and unauthenticated: any visitor submitting a form with a malicious User-Agent header can plant the payload, which then executes in the browser of a privileged user viewing the report. See the Wordfence Vulnerability Report for full technical breakdown.

// No verified public proof-of-concept is available.
// Refer to the vendor changeset for the patched query construction:
// https://plugins.trac.wordpress.org/changeset/3374106/

Detection Methods for CVE-2025-11204

Indicators of Compromise

Unexpected UNION SELECT, SLEEP(, or INFORMATION_SCHEMA substrings in WordPress access logs targeting RegistrationMagic admin endpoints.
Anomalous User-Agent header values containing <script>, onerror=, or javascript: sequences on form submission requests.
Unusual database read volume or slow queries originating from wp-admin sessions associated with the reports view.
New or modified administrator accounts following suspicious admin session activity.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect POST parameters routed to the RegistrationMagic reports service for SQL metacharacters.
Enable MySQL general query logging temporarily to identify malformed queries generated by the plugin.
Monitor administrator sessions for concurrent logins from disparate IP addresses, which may indicate stolen credentials being used to exploit the SQL Injection path.

Monitoring Recommendations

Alert on HTTP requests where the User-Agent header contains HTML or JavaScript syntax.
Track WordPress wp_users and wp_usermeta table read patterns for unusual bulk queries.
Correlate plugin update status across the WordPress fleet to surface hosts still running versions at or below 6.0.6.2.

How to Mitigate CVE-2025-11204

Immediate Actions Required

Update the RegistrationMagic plugin to the latest patched release published after changeset 3374106.
Audit WordPress administrator accounts and rotate credentials for any account that accessed the reports interface during the exposure window.
Review WordPress database logs for evidence of unauthorized SELECT queries returning sensitive tables.
Restrict administrator access to trusted IP ranges through .htaccess or reverse proxy controls until patching completes.

Patch Information

The vendor addressed the vulnerability in a subsequent release referenced in the WordPress Plugin Changeset 3374106. The fix introduces proper escaping and prepared statements in class_rm_reports_service.php. Site operators should upgrade beyond version 6.0.6.2 via the WordPress Plugin Overview page.

Workarounds

Deactivate the RegistrationMagic plugin until the patched version is deployed.
Enforce Multi-Factor Authentication (MFA) on all WordPress administrator accounts to reduce the risk of the authenticated SQL Injection path.
Deploy a WAF rule set that strips or blocks HTML and script tokens in the User-Agent header on requests reaching the plugin submission endpoints.
Limit wp-admin access to a VPN or allowlisted IP range while the patch is being rolled out.

bash

# Example: block requests with script tags in User-Agent at the nginx layer
if ($http_user_agent ~* "(<script|onerror=|javascript:)") {
    return 403;
}