CVE-2026-77790: RegistrationMagic WordPress SQL Injection

CVE-2026-77790 Overview

CVE-2026-77790 is a SQL injection vulnerability in the RegistrationMagic WordPress plugin versions prior to 6.0.9.4. The plugin fails to sanitize and escape a parameter before passing it into a SQL statement. High-privilege users, such as administrators, can inject arbitrary SQL through the vulnerable parameter. Successful exploitation allows attackers to read, modify, or delete data stored in the underlying WordPress database.

Critical Impact

Authenticated administrators can execute arbitrary SQL queries against the WordPress database through an unsanitized parameter in the RegistrationMagic plugin.

Affected Products

• RegistrationMagic WordPress plugin versions before 6.0.9.4
• WordPress sites running RegistrationMagic with administrative accounts
• Multisite WordPress deployments with the plugin installed on any subsite

Discovery Timeline

• 2026-08-26 - CVE-2026-77790 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77790

Vulnerability Analysis

The RegistrationMagic plugin processes a request parameter and passes it into a SQL query without applying proper sanitization or escaping. WordPress provides $wpdb->prepare() and related helpers for safe parameter binding, but the affected code path bypasses these protections. Because the vulnerable code path requires administrator privileges, exploitation is limited to authenticated high-privilege accounts. However, this scenario remains relevant in cross-site request forgery chains, compromised admin credentials, and multi-admin environments where privilege separation matters. The EPSS score for this CVE is 0.19% at the 8.68 percentile, reflecting low observed exploitation activity as of publication.

Root Cause

The root cause is missing input sanitization and escaping on a user-supplied parameter before concatenation into a SQL statement [CWE-89]. The plugin trusts input from authenticated administrator requests and does not enforce parameterized queries at the vulnerable code path.

Attack Vector

An attacker with administrator credentials, or one who successfully targets an administrator through session hijacking or CSRF, submits a crafted parameter value to the vulnerable RegistrationMagic endpoint. The malicious SQL payload is interpolated directly into the query executed against the WordPress database. Refer to the WPScan Vulnerability Report for parameter-level technical details.

Detection Methods for CVE-2026-77790

Indicators of Compromise

• Unusual SQL syntax such as UNION SELECT, SLEEP(, or comment sequences appearing in WordPress access logs on RegistrationMagic endpoints
• Unexpected database read errors or query timeouts originating from wp-admin requests to the plugin
• New or modified rows in wp_users, wp_usermeta, or plugin-specific tables without corresponding administrative activity

Detection Strategies

• Review web server and PHP error logs for RegistrationMagic requests containing SQL metacharacters in query parameters
• Deploy a web application firewall rule set that flags SQL injection patterns targeting /wp-admin/admin.php?page= requests routed to the plugin
• Correlate administrator authentication events with subsequent database schema queries to identify anomalous behavior

Monitoring Recommendations

• Enable WordPress query logging via SAVEQUERIES in staging to baseline normal plugin traffic
• Alert on any successful queries executed by the WordPress database user that reference information_schema tables
• Monitor changes to administrator accounts and role assignments in near real time

How to Mitigate CVE-2026-77790

Immediate Actions Required

• Upgrade the RegistrationMagic plugin to version 6.0.9.4 or later on all WordPress installations
• Audit all administrator accounts, remove unused privileged users, and rotate credentials for active administrators
• Enforce multi-factor authentication for every account with administrator or editor roles

Patch Information

The vendor addressed the issue in RegistrationMagic version 6.0.9.4. Update the plugin through the WordPress plugin dashboard or by replacing the plugin directory with the patched release. See the WPScan Vulnerability Report for advisory details.

Workarounds

• Restrict access to /wp-admin/ by IP address using web server configuration or a WAF policy until patching is complete
• Temporarily deactivate the RegistrationMagic plugin if the affected functionality is not business-critical
• Apply a WAF virtual patch that blocks SQL metacharacters in RegistrationMagic request parameters

# Configuration example: restrict wp-admin access via nginx
location ^~ /wp-admin/ {
    allow 203.0.113.0/24;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}