What the vulnerability does
01Description
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the payment actually went through PayPal. This makes it possible for unauthenticated attackers to bypass paid registration by manipulating payment status and activating their account without completing a real PayPal payment.
Explanation of Vulnerability in Simple Terms
02Summary
RegistrationMagic versions up to 6.0.6.9 contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network without user interaction. The vulnerability stems from insufficient input validation or access controls. Site administrators should update to a version newer than 6.0.6.9 to mitigate the risk of unauthorized data modification.
What an attacker can do
03Attacker Capabilities
Modify data on the site without authentication or user interaction.
Potential impact on your site
04Site Impact
Unauthorized changes to site data, potentially affecting user registrations, forms, or stored information.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user action required.
Key dates
06Disclosure timeline
February 18, 2026
CVE published
April 8, 2026
Record updated
