The RegistrationMagic plugin includes unsanitized user parameters in certain SQL calls, granting administrators the ability to inject arbitrary SQL when submitting registration forms. This allows extraction of sensitive database contents. In addition, unauthenticated users can trigger reflected XSS through the user‑agent header on form submissions. The flaw is a classic SQL injection (CWE‑89).

Vendor Metagauss provides the RegistrationMagic plugin, named Custom Registration Forms, User Registration, Payment, and User Login. Versions through 6.0.6.2, inclusive, contain the vulnerability. Any site running this plugin up to that version is affected; sites on newer releases are presumed patched.

The maximum exploit severity is a CVSS score of 7.2. The EPSS score is below 1 %, indicating a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the SQL injection requires an administrator or higher privilege, the attack surface is limited to site owners and trusted backend users. The XSS vector is unauthenticated, but its impact is limited to reflected script execution, which can be leveraged for phishing or session hijacking. Overall, the risk is medium with a low likelihood of exploitation in the wild.