What is the CVSS score of CVE-2026-9242?

CVE-2026-9242 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

RegistrationMagic CVE-2026-9242

EUVD-2026-39949 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-06-27 Wordfence

GHSA-jxxc-m933-38gm

WordPress Authentication Bypass Wordpress Plugin Registrationmagic Custom Registration Forms User Registration Payment And User Login Metagauss

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

8.7 HIGH

AC:H reflects prerequisite security hash from prior legitimate payment; S:C and C:H/I:H reflect full admin account takeover outcome, not the scored I:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 07:52 vuln.today

CVE Published

Jun 27, 2026 - 06:50 cve.org

MEDIUM 5.3

DescriptionCVE.org

The RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN callback handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data - including payment_status and the custom field encoding the target user_id - before PayPal IPN validation is performed, meaning the database remains poisoned even when validation subsequently fails. This makes it possible for unauthenticated attackers to authenticate as any WordPress user, including administrators, by submitting a forged IPN request that overwrites a payment log entry's user_id with that of a target account, then visiting the success return URL with a legitimately obtained security hash to cause the plugin to issue real WordPress authentication cookies for the targeted account.

AnalysisAI

Authentication bypass in the RegistrationMagic WordPress plugin (all versions through 6.0.8.6) permits an unauthenticated attacker with a prior legitimate payment transaction on the target site to obtain real WordPress session cookies for any user account, including administrators. The flaw exploits a fatally inverted processing order in the PayPal IPN callback handler: attacker-controlled POST data including the target user_id is written to the payment log database before PayPal IPN validation is performed, and the database poisoning persists even after validation subsequently rejects the forged notification. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the account-takeover impact makes this a critical priority for any site running the plugin with active PayPal payment integration.

Technical ContextAI

The vulnerable component is the PayPal Instant Payment Notification callback handler within the RegistrationMagic plugin by Metagauss (CPE: cpe:2.3:a:metagauss:registrationmagic_-_custom_registration_forms,_user_registration,_payment,_and_user_login:*:*:*:*:*:*:*:*), registered as a WordPress nopriv AJAX action - meaning it accepts unauthenticated POST requests with no nonce verification. The root cause is CWE-345 (Insufficient Verification of Data Authenticity): at class_rm_paypal_service.php lines 110 and 155, the handler immediately writes attacker-supplied POST fields - including payment_status and the custom field that encodes the target user_id - into the payment log database row. Only afterward does it attempt to validate the IPN with PayPal's servers (class_rm_utilities.php line 1384). Because the database write precedes any authenticity check, the poisoned user_id persists regardless of validation outcome. A second endpoint at class_rm_public.php line 728 handles the payment success return URL and reads the now-poisoned user_id to issue WordPress authentication cookies via wp_set_auth_cookie(), completing the account takeover chain.

RemediationAI

A code fix has been committed to the plugin trunk in the WordPress SVN repository (changeset 3532900), but the version number of a stable patched release has not been independently confirmed from available data - site administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcf68fd-e9d3-4a46-8bd4-15c2598b91fe and the official WordPress plugin page for a release beyond 6.0.8.6 incorporating this fix, and upgrade immediately upon availability. As an immediate compensating control, disable the PayPal payment gateway within RegistrationMagic settings to eliminate the vulnerable nopriv IPN callback surface entirely - this prevents PayPal payment processing but fully removes the attack vector with no other site functionality impact. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php with the action parameter set to rm_paypal_ipn from any source IP outside PayPal's published IPN sender ranges will prevent forged IPN submission while preserving legitimate PayPal functionality, though this requires maintaining an up-to-date PayPal IP allowlist. Do not use the provided CVSS score of 5.3 to deprioritize this finding - the actual account-takeover impact is materially higher.