CVE-2025-11204

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11204", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-30T21:04:18.462Z", "datePublished": "2025-10-08T04:23:40.019Z", "dateUpdated": "2026-04-08T16:49:31.725Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:31.725Z"}, "affected": [{"vendor": "metagauss", "product": "RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.0.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting."}], "title": "RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4532cb38-453b-460c-879d-6f0e1caacafc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/trunk/services/class_rm_reports_service.php?rev=3360241"}, {"url": "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3374106/custom-registration-form-builder-with-submission-manager/trunk?contextall=1&old=3366909&old_path=%2Fcustom-registration-form-builder-with-submission-manager%2Ftrunk"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "timeline": [{"time": "2025-10-07T16:05:36.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-08T15:42:37.762553Z", "id": "CVE-2025-11204", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T15:42:48.759Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11204", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-08T15:42:37.762553Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T15:42:44.762Z"}}], "cna": {"title": "RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "metagauss", "product": "RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-07T16:05:36.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4532cb38-453b-460c-879d-6f0e1caacafc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/trunk/services/class_rm_reports_service.php?rev=3360241"}, {"url": "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3374106/custom-registration-form-builder-with-submission-manager/trunk?contextall=1&old=3366909&old_path=%2Fcustom-registration-form-builder-with-submission-manager%2Ftrunk"}], "descriptions": [{"lang": "en", "value": "The RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:31.725Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11204", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:49:31.725Z", "dateReserved": "2025-09-30T21:04:18.462Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-08T04:23:40.019Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login", "vendor": "metagauss", "versions": [{"lessThanOrEqual": "6.0.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RegistrationMagic \u2013 Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 6.0.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An unauthenticated attacker could utilize an injected Cross-Site Scripting via user-agent on form submission to leverage this to achieve Reflected Cross-Site Scripting."}, {"lang": "es", "value": "El plugin RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login para WordPress es vulnerable a inyecci\u00f3n SQL en todas las versiones hasta, e incluyendo, 6.0.6.2 debido a escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes autenticados, con acceso de administrador o superior, a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos. Un atacante no autenticado podr\u00eda utilizar un cross-site scripting inyectado a trav\u00e9s del user-agent en el env\u00edo del formulario para aprovechar esto y lograr Cross-Site Scripting Reflejado."}], "id": "CVE-2025-11204", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11204", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-08T15:42:37.762553Z", "version": "2.0.3"}}]}, "published": "2025-10-08T05:15:31.390", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/trunk/services/class_rm_reports_service.php?rev=3360241"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3374106/custom-registration-form-builder-with-submission-manager/trunk?contextall=1&old=3366909&old_path=%2Fcustom-registration-form-builder-with-submission-manager%2Ftrunk"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4532cb38-453b-460c-879d-6f0e1caacafc?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:14:26.595122+00:00", "value": {"mitigation_remediation": ["Upgrade the RegistrationMagic plugin to a version newer than 6.0.6.2 to eliminate the SQL injection and XSS vectors.", "Disable or restrict the user\u2011agent string handling for form submissions, or sanitize the header input to prevent reflected XSS.", "Ensure that only trusted administrators have access to the plugin's back\u2011end and consider enforcing multi\u2011factor authentication for admin accounts."], "summary": {"action": "Apply Patch", "impact": "Data exfiltration via SQL injection"}, "threat_synthesis": {"affected_systems": "Vendor Metagauss provides the RegistrationMagic plugin, named Custom Registration Forms, User Registration, Payment, and User Login. Versions through 6.0.6.2, inclusive, contain the vulnerability. Any site running this plugin up to that version is affected; sites on newer releases are presumed patched.", "description_and_impact": "The RegistrationMagic plugin includes unsanitized user parameters in certain SQL calls, granting administrators the ability to inject arbitrary SQL when submitting registration forms. This allows extraction of sensitive database contents. In addition, unauthenticated users can trigger reflected XSS through the user\u2011agent header on form submissions. The flaw is a classic SQL injection (CWE\u201189).", "risk_and_exploitability": "The maximum exploit severity is a CVSS score of 7.2. The EPSS score is below 1\u202f%, indicating a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because the SQL injection requires an administrator or higher privilege, the attack surface is limited to site owners and trusted backend users. The XSS vector is unauthenticated, but its impact is limited to reflected script execution, which can be leveraged for phishing or session hijacking. Overall, the risk is medium with a low likelihood of exploitation in the wild."}}}}, "created": "2025-10-08T13:35:10.342899+00:00", "updated": "2026-04-22T13:15:17.851129+00:00", "vendors": ["metagauss", "metagauss$PRODUCT$registrationmagic", "registrationmagic", "registrationmagic$PRODUCT$registrationmagic", "wordpress", "wordpress$PRODUCT$wordpress"]}