Description

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T15:17:39.543Z",
  "pubdate": "2026-09-02T15:17:39.543Z",
  "executiveSummary": "The RegistrationMagic WordPress plugin, in versions prior to 6.0.9.9, contains a critical vulnerability related to improper input validation of payment parameters during the registration process. This flaw allows unauthenticated attackers to bypass payment gateways and successfully complete paid registrations.\nBy manipulating the request parameters associated with the transaction, an attacker can deceive the application into confirming a successful payment status without actual funds being transferred or verified by a payment processor.\nThe vulnerability leads to unauthorized account creation and privilege escalation, as the plugin treats the registration as validated regardless of the actual payment status. This creates a severe security risk for platforms relying on RegistrationMagic for gated content, subscription services, or paid membership management. Because the flaw is accessible to unauthenticated users, it requires no prior system access, enabling mass account creation and service abuse. Remediation requires an immediate update to version 6.0.9.9 or later, which implements server-side price validation to ensure that payment integrity is maintained before account activation occurs.",
  "technicalDetails": "The vulnerability resides in the core payment processing logic of the RegistrationMagic plugin. The root cause is a deficiency in server-side validation regarding the 'total price' parameter during the checkout and registration handshake. The application relies on client-supplied data to determine the transaction state rather than validating the final order amount and payment status against the payment provider's API callback or server-side session data.\nThe attack flow proceeds as follows: 1) An attacker initiates a registration process for a paid service provided by RegistrationMagic. 2) During the payment submission phase, the attacker intercepts the HTTP request containing the checkout details, specifically the transaction amount and verification tokens. 3) By modifying these parameters—or by submitting a request that mimics a successful payment callback response—the attacker forces the plugin's backend logic to bypass the external payment gateway verification. 4) The plugin's server-side code fails to perform a secondary verification of the transaction amount or status with the payment processor.\nBecause the validation logic is implemented primarily on the client side or via trust-based assumptions of the incoming HTTP request data, the server assumes the transaction was successful and proceeds to finalize the registration record in the WordPress database. This creates an activated user account with the permissions associated with the paid tier, despite no payment being processed.\nThe vulnerable component is the payment verification module responsible for handling the registration callback. The flaw is exploitable over a network without authentication, as the registration endpoints are typically exposed to the public. The post-exploitation impact includes unauthorized access to premium features, potential access to user-gated administrative dashboards depending on the registration role assignment, and the ability to abuse the platform's resources by creating unlimited paid accounts without fiscal contribution.\nThe lack of server-side integrity checks allows an attacker to manipulate the 'price' or 'status' parameters in the POST request body. The application logic lacks a 'source of truth' mechanism where the server-side verifies the transaction ID and amount directly with the payment gateway (e.g., PayPal, Stripe) before flipping the user's account status to 'active' or 'paid' in the wp_users and wp_usermeta tables."
}