Description

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:47.800Z",
  "pubdate": "2026-08-06T22:16:47.800Z",
  "executiveSummary": "A critical validation vulnerability exists in the RegistrationMagic WordPress plugin affecting versions prior to 6.0.9.5.\nThe vulnerability involves improper payment verification and lack of transaction de-duplication during PayPal integration.\nThe core flaw allows unauthenticated remote attackers to finalize expensive paid registrations using a genuinely completed low-value PayPal capture.\nAttackers can additionally replay a single PayPal capture across an unlimited number of registrations, leading to severe financial bypass and unauthorized resource allocation.\nThe risk implications include potential financial loss for site operators, unauthorized access to premium gated content or services, and complete compromise of the payment integrity enforcement mechanism.\nExploitation requires the attacker to generate a valid low-value payment capture via PayPal, which is then leveraged maliciously against registration finalization workflows without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability stems from deficient server-side verification logic within the payment processing handler of the RegistrationMagic WordPress plugin prior to version 6.0.9.5.\nWhen processing PayPal transactions, the application's verification routine restricts its check solely to confirming whether the PayPal capture status is marked as COMPLETED.\nCrucially, the server-side code fails to validate or cross-reference critical transaction parameters such as the capture amount, transaction currency, intended payee, or prior transaction reuse against the specific registration parameters it is intended to finalize.\nFurthermore, the application lacks a de-duplication mechanism to track and invalidate previously processed capture identifiers, permitting multiple successful finalization requests to rely on the exact same payment receipt.\nTo execute an attack, an unauthenticated actor initiates a legitimate, low-cost transaction through the integrated PayPal gateway to obtain a genuine COMPLETED capture identifier.\nThe attacker then intercepts or directly constructs subsequent HTTP requests directed at the registration finalization endpoint, substituting the transaction identifier of the low-value capture.\nBecause the server implementation only verifies that the provided capture status is COMPLETED without evaluating monetary equivalence or transaction consumption state, the backend logic erroneously accepts the disparate or replayed capture as valid payment for an arbitrary, high-value paid registration.\nThis flaw manifests over the network via standard HTTP/HTTPS request handling mechanisms exposed by the plugin.\nNo authentication or specific privilege level is required to interact with the vulnerable transaction processing component, enabling unauthenticated remote exploitation.\nThe post-exploitation impact includes unauthorized acquisition of paid services, subscription tiers, or event registrations at a negligible cost, alongside the ability to endlessly reuse a solitary payment token for mass exploitation."
}