The vulnerability is present in the RegistrationMagic WordPress plugin in versions prior to 6.0.9.4, where the rm_sortby parameter is passed unfiltered into an SQL query. This flaw enables an authenticated administrator to inject arbitrary SQL statements, potentially exposing, modifying, or deleting sensitive data and compromising the integrity of the site database. The weakness is a classic SQL injection flaw (CWE-89).

Hosts running the RegistrationMagic plugin before version 6.0.9.4 are affected. The plugin is a WordPress extension that manages registrations and user data; any deployment of this plugin that has not been updated to at least 6.0.9.4 is at risk.

The vulnerability requires that the attacker already have administrative privileges on the WordPress site, as the injection is limited to the rm_sortby parameter processed by the plugin. Without escalating privileges, exploitation is not possible. The CVSS score is 5.5, the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploit at this time. Nevertheless, because the flaw can be leveraged by high‑privilege users to read or alter database contents, the risk to organizations that run outdated versions of the plugin is moderate to high, especially if compromised admin accounts are present.