What the vulnerability does
01Description
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.
Explanation of Vulnerability in Simple Terms
02Summary
RegistrationMagic versions before 6.0.9.5 contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network without user interaction. The vulnerability has low complexity and affects the integrity of information stored or processed by the application. Site administrators should update to version 6.0.9.5 or later immediately.
What an attacker can do
03Attacker Capabilities
Modify data on the site without authentication or user interaction.
Potential impact on your site
04Site Impact
Attackers can alter site data, user submissions, or configuration without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user action required.
Key dates
06Disclosure timeline
August 6, 2026
CVE published
