RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 84% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

1. ★★★★★ bipnet

   2mo ago

   Efficient and reliable support response.

   Read on wp.org ↗
2. ★★★★★ isabelf

   4mo ago

   I have tested several registration and profile builder plugins for WordPress, and RegistrationMagic has honestly been one of the most flexible options I’ve used so far. What I liked most is that it’s not just a simple form builder. You can create advanced registration workflows, custom user fields, multi-step forms, email notifications, user management, and even payment-enabled forms without needing multiple extra plugins. The interface takes a little time to fully explore because there are many features, but once you understand the layout it becomes very powerful. I especially appreciated: Easy custom field managementUser registration + login integrationGood control over form styling and behaviorAbility to manage submissions from dashboardWorks nicely with custom user rolesUseful free features compared to many competitors I also had a small compatibility issue during setup and the support team responded faster than expected. They actually looked into the issue instead of sending generic replies, which is becoming rare these days. No plugin is perfect, and there is a slight learning curve if you are completely new, but overall this plugin saved me a lot of development time and removed the need for several separate plugins. If your website needs advanced user registration or member signup forms, RegistrationMagic is definitely worth trying. 5 stars from me.

   Read on wp.org ↗
3. ★★★★★ michelemac

   4mo ago

   Within a few days they fixed the problem and updated the plugin.

   Read on wp.org ↗
4. ★★★★★ sandfly1

   5mo ago

   I had issues with my form populating into the WordPress user profile. I submitted a ticket and support got it working for me.

   Read on wp.org ↗
5. ★★★★★ Anonymous

   6mo ago

   Thanks to support staff very efficently have solved a strange problem about personal setup

   Read on wp.org ↗
6. ★★★★★ lilacgoose01

   1.2y ago

   I tried numerous other plug-ins in an attempt to complete my project, yet all failed me BUT this one.This plug-in will add a robust registration feature to your website. While many other plug-ins only look good during their advertisement, this one really provides what it said. Most importantly, the documentations actually help. I also love the fact that you can modify and customize anything on the form you make. Features matter but so as theme-matching visuals!I believe it always depends on the situation, but I was able to receive support very quickly when I needed it. The support rep follows your question/request thoroughly and the premium plan is definitely worth every buck and penny you pay. Go ahead and install it on your WordPress website and try it out! Literally, it’s magic. This topic was modified 1 year, 1 month ago by lilacgoose01.

   Read on wp.org ↗
7. ★★★★★ robertodimaio

   1.3y ago

   I used the Registration Magic premium plugin for several years until it started giving me problems with the e-commerce module, causing sudden blocks in loading pages and a saturation of requests to the server. I contacted support, they responded promptly but denied there was a problem. Unable to wait for further responses, I replaced Registration Magic with another plugin and was pleasantly surprised that the site is much faster than before.

   Read on wp.org ↗
8. ★★★★★ eelcobruinsma

   1.4y ago

   With the RegistrationMagic plugin I was able to adapt to a diverse set of scenarios and wishes from clients, one being myself. The plugin allows for a very granular configuration of forms. I only briefly needed the membership functionality, but that worked too, so if I need it again, I don’t have to look elsewhere. Managing the forms and moderating the submissions requires some insight in where things are, but after having familiarized yourself with the interface, its many facets, and the possibilities of RM, you’re good to go. RM forms can be easily integrated in the design of a site without standing out as something foreign. Support, in my experience, is splendid and personal.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.0.9.6 Security patches. Minor UI improvements & bug fixes. 6.0.9.6
2. — Version 6.0.9.5 Fixed: Required fields not accepting “0” as input. Security: Fixed unauthenticated payment bypass vulnerability. Credit: Thanks to Pedro Pinho for responsibly reporting the security vulnerability. 6.0.9.5
3. — Version 6.0.9.4 New: Included option to add form field data to new submission email subject. Fixed: Required attribute not working for T&C field when scrolling is mandatory. Security: Fixed an IDOR vulnerability. Security: Fixed an auth 6.0.9.4
4. — Version 6.0.9.3 Minor design adjustments. 6.0.9.3
5. — Version 6.0.9.2 Security patches. Minor UI improvements & bug fixes. 6.0.9.2
6. — Version 6.0.9.1 Minor UI improvements. 6.0.9.1

55 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 8.1 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.9.7 - Unauthenticated PHP Object Injection ↗
   2026-08-18 CVE-2026-73341 Deserialization of Untrusted Data Affects <= 6.0.9.7 Patched in 6.0.9.8
2. Medium · 5.3 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Missing Authorization ↗
   2026-07-30 CVE-2026-15257 Missing Authorization Affects < 6.0.9.4 Patched in 6.0.9.4
3. Medium · 5.3 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Unauthenticated Insecure Direct Object Reference ↗
   2026-07-30 CVE-2026-15255 Authorization Bypass Through User-Controlled Key Affects < 6.0.9.4 Patched in 6.0.9.4
4. Medium · 5.3 RegistrationMagic <= 6.0.9.4 - Unauthenticated Price Manipulation ↗
   2026-07-20 CVE-2026-15208 Client-Side Enforcement of Server-Side Security Affects <= 6.0.9.4 Patched in 6.0.9.5
5. High · 8.8 RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter ↗
   2026-06-30 CVE-2026-12158 Cross-Site Request Forgery (CSRF) Affects <= 6.0.9.1 Patched in 6.0.9.2
6. Medium · 5.3 RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request ↗
   2026-06-26 CVE-2026-9242 Insufficient Verification of Data Authenticity Affects <= 6.0.8.6 Patched in 6.0.8.7
7. Medium · 5.3 RegistrationMagic – User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization ↗
   2026-06-04 CVE-2026-49764 Missing Authorization Affects <= 6.0.8.6 Patched in 6.0.8.7
8. Medium · 5.3 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization ↗
   2026-03-20 CVE-2026-32498 Missing Authorization Affects <= 6.0.7.6 Patched in 6.0.7.7
9. Critical · 9.8 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass ↗
   2026-03-12 CVE-2026-24373 Improper Authentication Affects <= 6.0.7.1 Patched in 6.0.7.2
10. Medium · 4.3 RegistrationMagic <= 6.0.7.6 - Missing Authorization ↗
    2026-02-18 CVE-2026-32385 Missing Authorization Affects <= 6.0.7.6 Patched in 6.0.7.7
11. Medium · 5.3 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment ↗
    2026-02-17 CVE-2025-14444 Insufficient Verification of Data Authenticity Affects <= 6.0.6.9 Patched in 6.0.7.0
12. Medium · 4.3 RegistrationMagic < 6.0.7.2 - Missing Authorization ↗
    2026-02-16 CVE-2026-0929 Missing Authorization Affects < 6.0.7.2 Patched in 6.0.7.2
13. Medium · 5.3 RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification ↗
    2026-01-27 CVE-2026-1054 Missing Authorization Affects <= 6.0.7.4 Patched in 6.0.7.5
14. Medium · 5.3 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure ↗
    2026-01-23 CVE-2025-15520 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 6.0.7.1 Patched in 6.0.7.2
15. Critical · 9.8 RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order ↗
    2026-01-16 CVE-2025-15403 Improper Privilege Management Affects <= 6.0.7.1 Patched in 6.0.7.2
16. Medium · 4.3 RegistrationMagic <= 6.0.6.9 - Cross-Site Request Forgery ↗
    2026-01-10 CVE-2026-24374 Cross-Site Request Forgery (CSRF) Affects <= 6.0.6.9 Patched in 6.0.7.0
17. Medium · 6.4 RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode ↗
    2025-12-15 CVE-2025-13610 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.0.6.7 Patched in 6.0.6.8
18. High · 7.2 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection ↗
    2025-10-07 CVE-2025-11204 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 6.0.6.2 Patched in 6.0.6.3
19. Medium · 6.4 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2025-04-02 CVE-2025-2836 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.0.4.3 Patched in 6.0.4.4
20. Medium · 4.4 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-03-03 CVE-2024-9390 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.0.2 Patched in 6.0.2.1
21. Medium · 6.1 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.3.3 - Reflected Cross-Site Scripting ↗
    2025-01-28 CVE-2025-24686 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.0.3.3 Patched in 6.0.3.4
22. Critical · 9.8 RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery ↗
    2024-11-08 CVE-2024-10508 Improper Handling of Missing Values Affects <= 6.0.2.6 Patched in 6.0.2.7
23. High · 7.2 RegistrationMagic <= 6.0.1.0 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-08-16 CVE-2024-43317 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.0.1.0 Patched in 6.0.1.1
24. High · 7.2 RegistrationMagic <= 6.0.0.1 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-08-01 CVE-2024-39643 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.0.0.1 Patched in 6.0.0.2
25. Medium · 6.1 RegistrationMagic <= 5.3.2.0 - Reflected Cross-Site Scripting ↗
    2024-04-30 CVE-2024-33947 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.3.2.0 Patched in 5.3.2.1
26. High · 8.8 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode ↗
    2024-03-26 CVE-2024-1990 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.3.1.0 Patched in 5.3.2.0
27. Medium · 4.3 RegistrationMagic <= 5.3.0.0 - Cross-Site Request Forgery ↗
    2024-03-26 CVE-2024-2951 Cross-Site Request Forgery (CSRF) Affects <= 5.3.0.0 Patched in 5.3.1.0
28. Medium · 6.1 RegistrationMagic <= 5.2.5.9 - Reflected Cross-Site Scripting ↗
    2024-03-16 CVE-2024-29113 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.5.9 Patched in 5.2.6.0
29. High · 8.8 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation ↗
    2024-03-14 CVE-2024-1991 Missing Authorization Affects <= 5.3.0.0 Patched in 5.3.1.0
30. Medium · 4.3 RegistrationMagic <= 5.2.5.9 - Cross-Site Request Forgery ↗
    2024-02-20 CVE-2024-25935 Cross-Site Request Forgery (CSRF) Affects <= 5.2.5.9 Patched in 5.2.6.0
31. Medium · 5.3 RegistrationMagic <= 5.2.5.0 - IP Spoofing ↗
    2023-12-27 CVE-2023-51543 Protection Mechanism Failure Affects <= 5.2.5.0 Patched in 5.2.5.1
32. Medium · 5.3 RegistrationMagic <= 5.2.5.0 - Form Submission Limit Bypass ↗
    2023-12-27 CVE-2023-51544 Protection Mechanism Failure Affects <= 5.2.5.0 Patched in 5.2.5.1
33. Medium · 6.6 RegistrationMagic Plugin <= 5.2.4.5 - Authenticated(Administrator+) SQL Injection ↗
    2023-12-21 CVE-2023-50846 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 5.2.4.6 Patched in 5.2.4.6
34. Medium · 5.3 RegistrationMagic <= 5.2.3.0 - Missing Authorization ↗
    2023-12-05 CVE-2023-49831 Missing Authorization Affects <= 5.2.3.0 Patched in 5.2.3.1
35. Medium · 4.3 RegistrationMagic <= 5.2.2.6 - Cross-Site Request Forgery ↗
    2023-11-27 CVE-2023-47645 Cross-Site Request Forgery (CSRF) Affects <= 5.2.2.6 Patched in 5.2.3.0
36. Medium · 6.1 RegistrationMagic <= 5.2.4.1 - Reflected Cross-Site Scripting via section_id ↗
    2023-10-07 CVE-2023-51509 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.2.4.2 Patched in 5.2.4.2
37. Critical · 9.8 RegistrationMagic <= 5.2.1.0 - Authentication Bypass ↗
    2023-05-15 CVE-2023-2499 Authentication Bypass Using an Alternate Path or Channel Affects <= 5.2.1.0 Patched in 5.2.1.1
38. Medium · 6.6 RegistrationMagic <= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change ↗
    2023-05-12 CVE-2023-2548 Authorization Bypass Through User-Controlled Key Affects <= 5.2.0.5 Patched in 5.2.1.0
39. Medium · 5.4 RegistrationMagic <= 5.1.9.2 - Cross-Site Request Forgery leading to Form Metadata Deletion ↗
    2023-02-17 CVE-2023-25991 Cross-Site Request Forgery (CSRF) Affects <= 5.1.9.2 Patched in 5.1.9.3
40. Medium · 5.3 RegistrationMagic <= 5.1.9.2 - Missing Authorization to Unauthenticated Content Injection ↗
    2023-01-20 CVE-2023-23989 Missing Authorization Affects <= 5.1.9.2 Patched in 5.1.9.3
41. Medium · 5.3 RegistrationMagic <= 5.1.9.2 - Improper Authorization to Price Change ↗
    2023-01-20 CVE-2023-23976 Improper Authorization Affects <= 5.1.9.2 Patched in 5.1.9.3
42. High · 7.2 RegistrationMagic <= 5.0.2.1 - SQL Injection ↗
    2022-02-07 CVE-2022-0420 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 5.0.2.2 Patched in 5.0.2.2
43. High · 8.8 RegistrationMagic <= 5.0.1.5 - SQL Injection ↗
    2022-01-23 CVE-2021-24862 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.0.1.5 Patched in 5.0.1.6
44. Medium · 6.1 Registration Magic <= 5.0.1.8 - Reflected Cross-Site Scripting ↗
    2021-12-28 CVE-2021-24648 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.0.1.8 Patched in 5.0.1.9
45. Critical · 9.8 RegistrationMagic <= 5.0.1.7 - Authentication Bypass ↗
    2021-12-08 CVE-2021-4073 Improper Authentication Affects <= 5.0.1.7 Patched in 5.0.1.8
46. High · 8.0 RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Cross-Site Request Forgery to Settings Modification ↗
    2020-03-05 CVE-2020-9454 Cross-Site Request Forgery (CSRF) Affects < 4.6.0.4 Patched in 4.6.0.4
47. Critical · 9.9 RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Privilege Escalation ↗
    2020-03-05 CVE-2020-9456 Missing Authorization Affects < 4.6.0.4 Patched in 4.6.0.4
48. Medium · 4.3 RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings and User Data Export ↗
    2020-03-05 CVE-2020-9458 Missing Authorization Affects < 4.6.0.4 Patched in 4.6.0.4
49. Medium · 4.3 RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Email Injection ↗
    2020-03-05 CVE-2020-9455 Missing Authorization Affects <= 4.6.0.3 Patched in 4.6.0.4
50. Critical · 9.9 RegistrationMagic – Custom Registration Forms and User Login <= 4.6.0.3 - Authenticated Settings Import to Privilege Escalation ↗
    2020-03-05 CVE-2020-9457 Missing Authorization Affects <= 4.6.0.3 Patched in 4.6.0.4
51. High · 8.1 RegistrationMagic - Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.2 - SQL Injection ↗
    2020-02-13 CVE-2020-8435 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 4.6.0.3 Patched in 4.6.0.3
52. Medium · 6.1 RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin <= 4.6.0.1 - Cross-Site Scripting ↗
    2020-01-30 CVE-2020-8436 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.6.0.1 Patched in 4.6.0.3
53. Medium · 6.1 RegistrationMagic - Custom Registration Forms <= 3.7.9.4 - Reflected Cross-Site Scripting ↗
    2017-12-10 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.7.9.2 Patched in 3.8.0.9
54. High · 8.8 RegistrationMagic - Custom Registration Forms <= 3.8.0.4 - SQL Injection ↗
    2017-12-10 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.8.0.4 Patched in 3.8.0.9
55. Critical · 9.8 RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection ↗
    2017-10-02 CVE-2017-20208 Deserialization of Untrusted Data Affects < 3.7.9.3 Patched in 3.7.9.3

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 22 languages, 1 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-05-08 9K+ → 8K+ down after 144 days in tier
2. 2025-12-15 10K+ → 9K+ down after 1 days in tier
3. 2025-12-14 9K+ → 10K+ up after 1 days in tier
4. 2025-12-13 10K+ → 9K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP 20K+ installs · 4.6★ · 3 shared tags A
• CM Registration – Tailored tool for seamless login and invitation-based registrations 30+ installs · 3.8★ · 3 shared tags B
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 40K+ installs · 4.7★ · 2 shared tags A
• New User Approve 20K+ installs · 4.3★ · 2 shared tags A
• Pie Register – User Registration, Profiles & Content Restriction 1K+ installs · 4.2★ · 2 shared tags A
• Registration Form for WooCommerce 1K+ installs · 4.1★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login into a readme, a review or a deck. It updates itself.

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: 8K+ active installs, 4.5★ (459 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/custom-registration-form-builder-with-submission-manager