External risk intelligence

RegistrationMagic PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73341

The vulnerability exists in a WordPress plugin designed for registration forms. Such plugins are typically deployed on public-facing web applications to collect user data, making them commonly reachable from the internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in certain versions of a plugin used for managing user registrations on websites. This issue allows unauthorized individuals to potentially inject malicious code, which could lead to significant compromise of the affected systems. The primary concern at this stage is to confirm if this plugin is in use and, if so, to what extent.

Unauthenticated code injection vulnerability in registration plugin.
Could impact public-facing websites and user data.
Confirm relevance and assess exposure across our platforms.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted PHP object to a web application using a vulnerable version of the RegistrationMagic plugin. This could allow the attacker to inject malicious code, potentially leading to complete system compromise.

No authentication required.
Triggered via crafted PHP object.
Allows code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an unauthenticated attacker to inject PHP objects into a WordPress site, potentially leading to the execution of arbitrary code. This could affect the integrity and availability of the website and its data.

Website data and code are at risk.
Unauthenticated object injection can occur.
Arbitrary code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability in RegistrationMagic affects WordPress plugins, likely managed by application owners or web administrators. The first practical step is to identify all instances of the plugin, determine their exposure and criticality, and then confirm the accountable owner for remediation.

Application owners should address this issue.
Verify plugin presence and external reachability.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is RegistrationMagic?

RegistrationMagic is a WordPress plugin used to build and manage custom registration forms. Website administrators rely on it to collect, store, and process user information, such as sign-up details and custom profile data, directly through their site's interface.

What does PHP object injection mean for CVE-2026-73341?

This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), occurs when the application processes malicious user-supplied data as a PHP object. By injecting these crafted objects, an attacker can manipulate how the application functions, potentially leading to unauthorized code execution.

How is this vulnerability triggered?

An attacker triggers this by sending a specifically formatted PHP object to the web application. The vulnerability requires no prior authentication, meaning an attacker does not need an account to attempt the injection. Simply viewing or interacting with a normal site page without submitting a malicious object will not trigger this.

Is my site at risk?

According to Halo Surface Signal, this plugin is typically used on public-facing web applications to capture visitor data, making it likely that installations are reachable from the internet. If your WordPress site uses an affected version, it faces a higher risk of external access compared to internal-only tools.

Do I need to take action if I use this plugin?

Yes. First, perform an inventory to confirm if you are running an affected version of RegistrationMagic. Once confirmed, coordinate with your web administration or application owners to assess the plugin's reachability, monitor for relevant vendor security updates, and prioritize necessary remediation steps.

References

patchstack.com/database/wordpress/plugin/custom-registration-form-bu…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.