Security Alert Summary
The RegistrationMagic WordPress plugin before 6.0.9.9 fails to validate the total price of a paid registration on the server-side, which allows unauthenticated users to complete a paid registration without paying and obtain an activated account.
CVE Details
- CVE ID: CVE-2026-77793
- Affected component: RegistrationMagic WordPress plugin
- Affected versions: Versions prior to 6.0.9.9 (less than 6.0.9.9)
- Published: September 2, 2026, 3:17:39 PM
- Last modified: September 2, 2026, 3:17:39 PM
- CVSS v3.1: Base Score 5.3, Severity MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact – Confidentiality / Integrity / Availability: None / Low / None
- CWE / weakness: CWE-602
Technical Details
The plugin does not perform server-side validation of the total price for a paid registration flow. Because the total price is not validated on the server, an attacker can submit a registration request that bypasses payment checks and complete an order without paying. Successful exploitation results in the creation of an activated account for the attacker.
No specific functions or REST endpoints are named in the provided data. The root cause described is a missing server-side verification of the payment/total amount during the registration workflow.
Impact is limited to allowing unauthenticated actors to create activated accounts without payment; the CVSS data indicates a low integrity impact and no confidentiality or availability impact.
How This Could Impact Your Website
In a realistic scenario, an external actor could register on your site, complete the site’s paid registration workflow without paying, and receive an activated account. This can complicate user management for a site owner and internal staff who rely on paid registrations as a gating mechanism. For example:
- The site owner or administrator may see unexpected active accounts in the user list and need to verify which registrations are legitimate.
- Internal staff or contractors who grant access based on a paid-registration flag could inadvertently grant privileges or resources to accounts created without payment.
- External contributors or contractors with access to member-only areas could be misled by attacker accounts that appear legitimate.
While the CVSS data indicates confidentiality impact is none, the presence of unauthorized activated accounts increases the risk of social engineering or misuse of member-only features. professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and any automated role assignments.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and registration logs for unusual behavior or spikes in new accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
