Security Alert Summary
The RegistrationMagic WordPress plugin before version 6.0.9.9 fails to validate a client-supplied quantity multiplier when calculating the total price for a paid registration. This allows unauthenticated users to register without paying and obtain an activated account holding the role assigned by the form.
CVE Details
- CVE ID: CVE-2026-77794
- Affected component: RegistrationMagic WordPress plugin
- Affected versions: Versions before 6.0.9.9 (example affected version listed: 6.0.0.0)
- Published: September 2, 2026 at 3:17:39 PM (as provided)
- Last modified: September 2, 2026 at 3:17:39 PM (as provided)
- CVSS v3.1: Base Score 5.3, Medium; Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication required; Privileges Required: None; User Interaction: None
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness: CWE-472
Technical Details
According to the reported description, the plugin does not validate a client-supplied quantity multiplier when computing the total price for a paid registration. Because this multiplier is not validated server-side, an attacker can supply a value that reduces the total to zero or otherwise bypass payment logic. The result is that an unauthenticated user can complete registration without paying and receive an activated account with whatever role the form grants.
No specific function names or endpoints are provided in the available data; the core issue is the lack of validation of a client-controlled numeric multiplier during price calculation.
How This Could Impact Your Website
On a site that uses RegistrationMagic to sell access or services, this vulnerability could allow an unauthenticated visitor to obtain an active user account with a role assigned by the registration form. For example, a site owner configures a registration form that grants a contributor role to paid registrants. An external contractor or random visitor could exploit the missing multiplier validation to register without payment and be issued that contributor account. Internal staff who expect payments for new accounts may not notice multiple low-privilege accounts being created, while the attacker could use those accounts for targeted actions such as submitting content or viewing restricted areas permitted to that role.
Practical consequences include exposure of account details for users who share roles or access levels, and an increased risk of targeted phishing or social engineering that leverages legitimately created accounts. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and new account creation for unusual behavior.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
