Is CVE-2026-82225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82225 being exploited in the wild.

How severe is CVE-2026-82225?

High severity, with a CVSS score of 7.4, published 31 August 2026.

Which products and versions are affected?

MagicFields RegistrationMagic <= 6.0.9.8.

Is there a fix for CVE-2026-82225?

A patch was published on 2026-08-28: Patched in version 6.0.9.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82225 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82225?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82225: RegistrationMagic broken authentication

Q: Is there a fix for CVE-2026-82225?

A patch was published on 2026-08-28: Patched in version 6.0.9.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-82225 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-82225?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82225 · Severity: high · CVSS 7.4 · Published 2026-08-31

RegistrationMagic is a popular WordPress plugin used to create user registration and form submission forms on websites. This vulnerability allows attackers to bypass the login system and log in as other users without knowing their passwords, potentially gaining unauthorized access to user accounts and sensitive information stored in the registration system.

Quick answers

Is CVE-2026-82225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82225 being exploited in the wild.
How severe is CVE-2026-82225?: High severity, with a CVSS score of 7.4, published 31 August 2026.
Which products and versions are affected?: MagicFields RegistrationMagic <= 6.0.9.8.
Is there a fix for CVE-2026-82225?: A patch was published on 2026-08-28: Patched in version 6.0.9.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82225 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82225?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken authentication flaw (OWASP A7) affecting RegistrationMagic versions 6.0.9.8 and below. The issue allows unauthenticated attackers to bypass the login mechanism and impersonate legitimate users without requiring valid credentials. The attack requires no prior authentication or special privileges and is exploitable over the network through the WordPress plugin interface. Successful exploitation grants attackers unauthorized access to user accounts and associated data. A patch is available in version 6.0.9.9 and later.

Affected products

MagicFields RegistrationMagic <= 6.0.9.8

Timeline

2026-08-31: disclosed: CVE-2026-82225 published on NVD
2026-08-28: other: Vulnerability reported and advisory published by Patchstack
2026-08-28: patched: Patched in version 6.0.9.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.