EUVD-2026-54197
GHSA-x5h9-fc29-gm85
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable with no WordPress authentication required and no user interaction; integrity impact is limited to fraudulent registration record creation within the application's own scope.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.
AnalysisAI
Payment bypass in RegistrationMagic WordPress plugin before 6.0.9.5 enables unauthenticated attackers to finalize arbitrarily-priced paid registrations using any previously-completed PayPal capture, regardless of its amount, currency, or intended payee. The plugin's server-side verification confirms only that a PayPal capture carries COMPLETED status, entirely omitting validation that the captured amount matches the registration fee, that the payee is the site's own account, or that the capture has not already been consumed. Because captures are not deduplicated, a single low-value legitimate capture can be replayed indefinitely to enroll unlimited users in high-value paid registrations at no cost - constituting scalable financial fraud. No public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
RegistrationMagic is a WordPress plugin providing event registration, membership management, and integrated payment processing. The vulnerability resides in the plugin's PayPal capture finalization handler: when a buyer submits a capture ID to complete a registration, the plugin calls the PayPal Orders API and checks only that the capture's status field equals COMPLETED, then unconditionally marks the registration as paid. It performs no server-side comparison of the captured amount against the registration price, no payee identity validation, no currency check, and maintains no ledger of previously-consumed capture IDs. This is a textbook business logic failure in payment integrity - the authentication of the payment instrument (a real PayPal capture) is verified, but its semantic validity for the specific transaction is entirely absent. The ENISA EUVD entry (EUVD-2026-54197) confirms the affected range as RegistrationMagic versions 0 through below 6.0.9.5. No CPE string was provided in available intelligence.
RemediationAI
Upgrade RegistrationMagic to version 6.0.9.5 or later, which is the vendor-confirmed patched release per WPScan (https://wpscan.com/vulnerability/b8c75098-41a9-4b24-9f6b-c3144f230cd8/); the update is available through the WordPress plugin dashboard under Dashboard > Updates. If immediate upgrade is not feasible, the most targeted compensating control is to disable PayPal as a payment method within RegistrationMagic's settings for all paid registration forms - this removes the vulnerable code path entirely, with the trade-off of disrupting automated PayPal-based payment flows until the patch is applied. If an alternative payment processor is configured (e.g., Stripe), switching paid forms to that processor avoids the vulnerable handler. After patching, administrators should audit PayPal capture usage in registration logs for duplicate capture IDs across multiple records to identify any pre-patch exploitation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today