EUVD-2026-39949
GHSA-jxxc-m933-38gm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconComplete legitimate payment on target site
-
DeliveryObtain security hash from own transaction
-
ExploitPOST forged IPN with admin user_id to nopriv AJAX endpoint
-
InstallPlugin writes poisoned user_id to DB before PayPal validation
-
C2IPN validation fails but DB poisoning persists
-
ExecuteVisit success return URL with legitimate security hash
-
ImpactReceive WordPress admin session cookies
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Exploitation requires three concurrent conditions to be met simultaneously. First, the target WordPress site must have RegistrationMagic installed and active with the PayPal payment gateway explicitly enabled and configured - sites using only alternative payment methods or no payment integration are not vulnerable through this path. Second, the attacker must possess a legitimately obtained security hash associated with at least one completed payment log entry on that specific target site, meaning they must have previously made a genuine purchase or registration payment through the plugin on the same installation being attacked. Third, the attacker must know or successfully enumerate a valid WordPress user_id for the target account, such as an administrator - low-numbered IDs (1, 2) are typical defaults. The IPN submission step itself requires no authentication because the callback is a nopriv AJAX action, but the prior customer relationship (legitimate payment transaction) on the exact target site is a non-trivial prerequisite that limits mass automated exploitation. There is no requirement for victim interaction at any stage of the attack. |
| Impact | The provided CVSS base score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N substantially misrepresents the actual impact: the described outcome is full administrative account takeover, not a minor integrity modification - C:N and I:L are inconsistent with an attacker receiving valid admin-level WordPress session cookies. This is a CVSS scoring discrepancy that defenders should account for. A meaningful exploitation prerequisite exists: the attacker must possess a legitimately obtained security hash derived from a prior genuine payment transaction on the target site, which raises the effective attack complexity and limits opportunistic mass exploitation. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. No CISA KEV listing exists and no public POC has been identified, meaning no confirmed active exploitation is known at time of analysis. Despite the high theoretical impact, the prerequisite of a prior legitimate customer transaction on the specific target site constrains this to targeted attacks rather than broad automated scanning, making it a priority for high-value sites (e-commerce, membership, SaaS) running RegistrationMagic with PayPal integration rather than a universal emergency. |
| Exploit ScenarioDerived | An attacker who has previously completed a legitimate payment on the target WordPress site - obtaining a valid security hash tied to their own payment log entry - submits a crafted unauthenticated HTTP POST to the site's AJAX endpoint targeting the rm_paypal_ipn action, with the custom field encoding the user_id of an administrator account (commonly user ID 1 or 2) and a fabricated payment_status value. The plugin immediately writes the admin's user_id into the payment log database before contacting PayPal for validation; even when PayPal rejects the forged IPN, the database row retains the admin's user_id. The attacker then loads the payment success return URL with their own legitimately obtained security hash, and the plugin issues WordPress session cookies authenticated as the administrator. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 27, 2026
Authentication bypass in the RegistrationMagic WordPress plugin (all versions through 6.0.8.6) permits an unauthenticated attacker with a prior legitimate payment transaction on the target site to obtain real WordPress session cookies for any user account, including administrators. The flaw exploits a fatally inverted processing order in the PayPal IPN callback handler: attacker-controlled POST data including the target user_id is written to the payment log database before PayPal IPN validation is performed, and the database poisoning persists even after validation subsequently rejects the forged notification. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the account-takeover impact makes this a critical priority for any site running the plugin with active PayPal payment integration.
RemediationAI
A code fix has been committed to the plugin trunk in the WordPress SVN repository (changeset 3532900), but the version number of a stable patched release has not been independently confirmed from available data - site administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1dcf68fd-e9d3-4a46-8bd4-15c2598b91fe and the official WordPress plugin page for a release beyond 6.0.8.6 incorporating this fix, and upgrade immediately upon availability. As an immediate compensating control, disable the PayPal payment gateway within RegistrationMagic settings to eliminate the vulnerable nopriv IPN callback surface entirely - this prevents PayPal payment processing but fully removes the attack vector with no other site functionality impact. Alternatively, a WAF rule blocking POST requests to wp-admin/admin-ajax.php with the action parameter set to rm_paypal_ipn from any source IP outside PayPal's published IPN sender ranges will prevent forged IPN submission while preserving legitimate PayPal functionality, though this requires maintaining an up-to-date PayPal IP allowlist. Do not use the provided CVSS score of 5.3 to deprioritize this finding - the actual account-takeover impact is materially higher.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is the PayPal Instant Payment Notification callback handler within the RegistrationMagic plugin by Metagauss (CPE: cpe:2.3:a:metagauss:registrationmagic_-_custom_registration_forms,_user_registration,_payment,_and_user_login:*:*:*:*:*:*:*:*), registered as a WordPress nopriv AJAX action - meaning it accepts unauthenticated POST requests with no nonce verification. The root cause is CWE-345 (Insufficient Verification of Data Authenticity): at class_rm_paypal_service.php lines 110 and 155, the handler immediately writes attacker-supplied POST fields - including payment_status and the custom field that encodes the target user_id - into the payment log database row. Only afterward does it attempt to validate the IPN with PayPal's servers (class_rm_utilities.php line 1384). Because the database write precedes any authenticity check, the poisoned user_id persists regardless of validation outcome. A second endpoint at class_rm_public.php line 728 handles the payment success return URL and reads the now-poisoned user_id to issue WordPress authentication cookies via wp_set_auth_cookie(), completing the account takeover chain.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H reflects prerequisite security hash from prior legitimate payment; S:C and C:H/I:H reflect full admin account takeover outcome, not the scored I:L.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN callback handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data - including payment_status and the custom field encoding the target user_id - before PayPal IPN validation is performed, meaning the database remains poisoned even when validation subsequently fails. This makes it possible for unauthenticated attackers to authenticate as any WordPress user, including administrators, by submitting a forged IPN request that overwrites a payment log entry's user_id with that of a target account, then visiting the success return URL with a legitimately obtained security hash to cause the plugin to issue real WordPress authentication cookies for the targeted account.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB