RegistrationMagic CVE-2026-77826

The Facebook social login integration must be enabled and configured within RegistrationMagic on the target WordPress site - installations that have never activated this feature are not exposed, as the vulnerable token validation logic is only reachable through the Facebook login flow. For the account takeover path, the attacker must obtain a valid Facebook access token belonging to an existing site user, which requires social engineering such as phishing the victim into authorizing an attacker-controlled Facebook application; the victim must hold a Facebook account linked to the target WordPress account. For the registration bypass path, no victim interaction is required - the attacker only needs their own valid Facebook access token from any application. Sites running RegistrationMagic 6.0.9.9 or later are not affected, nor are sites that have disabled the plugin or the Facebook login feature specifically.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the account takeover path, where the attacker must engineer a situation in which the victim authenticates to an attacker-controlled Facebook app - hence UI:R. A second, lower-interaction attack path (registration bypass using the attacker's own token) may not require any victim interaction at all, suggesting the practical exploitability floor is lower than the CVSS UI:R metric implies. The EPSS score of 0.15% at the 4th percentile is low despite publicly available exploit code from WPScan, indicating exploitation has not yet become widespread or automated. There is no CISA KEV listing. The realistic priority depends heavily on whether the Facebook social login feature is active on a given site - installations that never enabled it are unaffected - but where it is configured, the barrier to exploitation is modest and the impact is full account takeover.

An attacker registers their own Facebook application and crafts a phishing page that prompts a target WordPress site user to authorize it, obtaining the victim's Facebook access token in the process. The attacker then submits this token to the RegistrationMagic Facebook login endpoint on the target WordPress site; the plugin queries Facebook to confirm the token is valid but does not verify it was issued to the site's application, so it authenticates the attacker as the victim with full account privileges. Separately, an attacker with no victim cooperation can use their own Facebook token to register a new account on a site where administrator-controlled registration has been disabled. A public proof-of-concept is available via WPScan.