EUVD-2026-71848
GHSA-99w4-v9vm-vmmw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Token theft is attacker-controlled (AC:L), no site privileges needed (PR:N), but victim must authorize a Facebook app (UI:R); full account access yields C:H/I:H/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.
AnalysisAI
RegistrationMagic WordPress plugin before version 6.0.9.9 omits audience validation on Facebook OAuth access tokens during social login, creating two exploitable paths: an attacker who obtains any valid Facebook token belonging to a site user - regardless of which Facebook application issued it - can authenticate to the WordPress site as that user, and a separate path allows account creation even when site registration is explicitly disabled. Publicly available exploit code has been published by WPScan, and the high CIA impact score reflects that full account compromise is achievable on affected installations with the Facebook login feature enabled.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Facebook social login integration must be enabled and configured within RegistrationMagic on the target WordPress site - installations that have never activated this feature are not exposed, as the vulnerable token validation logic is only reachable through the Facebook login flow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the account takeover path, where the attacker must engineer a situation in which the victim authenticates to an attacker-controlled Facebook app - hence UI:R. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade RegistrationMagic to version 6.0.9.9 or later via the WordPress plugin dashboard or the vendor's distribution channel - this is the vendor-confirmed fix referenced in the WPScan advisory (https://wpscan.com/vulnerability/b79a83e8-d7b0-4aa8-b2ba-37a7eecd437b/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, verify whether RegistrationMagic is installed on your WordPress deployments and audit whether Facebook login is active; if active, consider disabling it until patches are applied. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Registrationmagic
View allIn the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (wi
The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) t
In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (wi
A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requ
The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. Rated high severity (CVSS 8.1), this vuln
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name paramet
The RegistrationMagic plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.2.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attac
Authentication bypass in the RegistrationMagic WordPress plugin (versions up to and including 6.0.8.6) allows unauthenti
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today