Description

Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T15:17:02.647Z",
  "pubdate": "2026-08-18T15:17:02.647Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in RegistrationMagic versions 6.0.9.7 and prior. This security flaw allows remote, unauthenticated threat actors to supply maliciously crafted serialized data to the application, which is then insecurely deserialized. The primary impact of this vulnerability includes potential remote code execution, unauthorized data access, or denial of service, depending on the availability of compatible gadget chains within the application's environment or third-party plugins. The affected systems encompass any WordPress installation utilizing vulnerable iterations of the RegistrationMagic plugin. The risk implications are severe due to the lack of authentication requirements, enabling opportunistic exploitation over the network by external entities. Attackers require network access to the target endpoint handling the insecure deserialization process. To mitigate this risk, immediate patching or updating of the RegistrationMagic plugin beyond version 6.0.9.7 is strictly recommended.",
  "technicalDetails": "The vulnerability stems from the insecure handling of user-supplied input that is passed directly into PHP's native deserialization mechanisms, such as unserialize(), without proper sanitization or validation. In RegistrationMagic versions 6.0.9.7 and prior, specific input parameters processed during registration or form handling routines accept serialized strings from unauthenticated users. When the application reconstructs these serialized objects, PHP automatically invokes magic methods such as __wakeup() or __destruct() if they are defined within the loaded classes. If the application environment includes vulnerable classes known as gadget chains—often originating from WordPress core, themes, or other installed plugins—an attacker can craft a malicious payload that leverages these methods to execute arbitrary system commands, manipulate application data, or perform arbitrary file operations. The attack flow begins when an unauthenticated remote attacker sends an HTTP request containing the specially crafted serialized payload to the vulnerable endpoint exposed by the RegistrationMagic plugin. Network exposure is broad, as the vulnerable components are typically accessible over standard HTTP/HTTPS ports without requiring prior authentication or administrative privileges. Upon receipt, the vulnerable component processes the input and passes it to the insecure deserialization function. The execution of the malicious payload occurs immediately during the object instantiation phase, bypassing standard application logic and access controls. Post-exploitation impact depends heavily on the execution context of the web server process and the presence of viable gadget chains, potentially granting full system compromise or persistence within the underlying hosting environment. Remediation requires rigorous input validation and the replacement of insecure native serialization formats with safer alternatives such as JSON."
}