Description

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T15:17:39.673Z",
  "pubdate": "2026-09-02T15:17:39.673Z",
  "executiveSummary": "The RegistrationMagic WordPress plugin, in versions prior to 6.0.9.9, is susceptible to a critical price manipulation vulnerability.\nThis flaw involves improper input validation of the quantity multiplier during the calculation of registration fees for paid forms.\nAn unauthenticated attacker can manipulate the price calculation logic to bypass payment requirements entirely.\nSuccessful exploitation results in the creation of an authorized account with the assigned user role associated with the specific registration form, despite no actual funds being transferred.\nThis vulnerability poses a significant security risk by allowing unauthorized access and potential privilege escalation within the WordPress environment.\nNo specific authentication or user privileges are required for an attacker to initiate this exploitation, making it accessible to remote, unauthenticated actors.\nThe core issue stems from the server-side reliance on client-supplied data for financial calculations without secondary validation or integrity checks.",
  "technicalDetails": "The vulnerability resides within the pricing calculation logic of the RegistrationMagic plugin. Specifically, the application fails to perform adequate server-side validation on user-supplied parameters that determine the final cost of a registration transaction, particularly the quantity multiplier field.\nIn a standard transaction flow, the plugin processes form submissions where the total price is a product of base service costs and a quantity field provided by the client. The server-side code processes this multiplier without verifying if the submitted value corresponds to a valid, authorized purchase quantity.\nAn attacker can intercept the HTTP POST request generated during the registration submission process. By modifying the parameter representing the quantity multiplier to a value such as zero or a negative number, the attacker can force the backend calculation to result in a total cost of zero or a nominal value.\nBecause the system trusts the incoming parameter to calculate the payment total, the payment gateway integration is bypassed or erroneously satisfied. Once the plugin receives the zero-cost confirmation, it proceeds to trigger the user creation workflow as if a successful payment transaction had been recorded.\nThe attack flow follows these steps: 1) The attacker navigates to a RegistrationMagic form configured for paid registration. 2) The attacker initiates the registration process and submits the form while intercepting the traffic using a proxy tool. 3) The attacker identifies the quantity multiplier parameter within the request body. 4) The attacker replaces the legitimate quantity value with a value intended to zero out the total price calculation. 5) The server processes the request, computes the price as zero, and marks the registration as complete. 6) The plugin provisions the new user account with the configured role assigned to the registration form.\nThis flaw effectively permits unauthenticated actors to bypass monetization controls and gain unauthorized application access. Post-exploitation impact includes the mass creation of unauthorized accounts with specific roles, which could lead to further exploitation depending on the permissions assigned to those roles within the WordPress installation.\nThe vulnerability is present in all versions of the RegistrationMagic plugin before 6.0.9.9. The lack of integrity verification for financial inputs represents a failure to adhere to secure coding practices regarding untrusted user input handling in sensitive business logic."
}