CVE-2026-77793: RegistrationMagic WordPress Auth Bypass Flaw

CVE-2026-77793 Overview

CVE-2026-77793 affects the RegistrationMagic WordPress plugin before version 6.0.9.9. The plugin fails to validate the total price of a paid registration on the server side. Unauthenticated attackers can complete a paid registration flow without paying and obtain an activated account. The flaw is categorized under CWE-602: Client-Side Enforcement of Server-Side Security. The issue is reachable over the network without authentication or user interaction.

Critical Impact
Unauthenticated users can bypass payment enforcement and gain activated accounts on affected WordPress sites, resulting in unauthorized access to paid content, services, or member-only functionality.

Affected Products

RegistrationMagic WordPress plugin versions prior to 6.0.9.9

Discovery Timeline

2026-09-02 - CVE-2026-77793 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-77793

Vulnerability Analysis

RegistrationMagic exposes a paid registration workflow that accepts price and payment state from the client. The server accepts the submitted total price value without recomputing or verifying it against the registration form configuration stored server-side. An attacker submitting a manipulated request can therefore drive the price to zero, mark payment as complete, or otherwise skip the payment gateway step. The server then treats the registration as paid and activates the account.

This is a business logic flaw rather than a memory-safety or injection issue. The registration handler trusts client-supplied financial data as authoritative. Because the entire flow is unauthenticated, any anonymous visitor can trigger the bypass against a vulnerable site.

Root Cause

The root cause is missing server-side validation of the transaction total. Per [CWE-602], security-relevant enforcement — in this case, the paid amount tied to a registration plan — must be recomputed and validated on the server. RegistrationMagic instead relies on values that originate from or pass through the client, which an attacker fully controls.

Attack Vector

An unauthenticated attacker submits a crafted paid-registration request to the plugin's registration endpoint. The attacker alters the price total, payment status, or related fields in the POST body before submission. The plugin accepts these values, bypasses the gateway charge, and provisions an activated account. Full technical details are documented in the WPScan Vulnerability Report.

No verified proof-of-concept code has been published. See the WPScan advisory for exploitation specifics.

Detection Methods for CVE-2026-77793

Indicators of Compromise

New user accounts created through RegistrationMagic marked as activated with no corresponding transaction record in the configured payment gateway (Stripe, PayPal, WooCommerce, etc.).
Registration submissions where the recorded total price is 0 or does not match the configured plan price.
Bursts of registrations from a single IP or user agent against endpoints exposed by the RegistrationMagic plugin.

Detection Strategies

Reconcile RegistrationMagic account activations against payment processor transaction logs and flag any activation without a matching successful charge.
Inspect webserver access logs for POST requests to RegistrationMagic AJAX and admin-ajax endpoints, correlating on unusual price parameters.
Enable WordPress database auditing on the plugin's transaction and user meta tables to identify tampered price fields.

Monitoring Recommendations

Alert on any RegistrationMagic registration where the stored amount is below the configured plan minimum.
Monitor for spikes in new activated accounts, particularly outside normal registration hours.
Track failed and zero-value payment gateway callbacks associated with the plugin.

How to Mitigate CVE-2026-77793

Immediate Actions Required

Update the RegistrationMagic plugin to version 6.0.9.9 or later on all WordPress sites.
Audit accounts created since the plugin was installed for registrations without a matching payment gateway charge and disable any that cannot be reconciled.
Rotate credentials and revoke sessions for suspicious accounts created through the plugin.

Patch Information

The vendor addressed the issue in RegistrationMagic 6.0.9.9 by enforcing server-side validation of the registration total. Site owners should apply this update through the WordPress plugin manager. Additional detail is available in the WPScan Vulnerability Report.

Workarounds

Temporarily disable paid registration forms in RegistrationMagic until the plugin is updated.
Restrict access to the plugin's registration endpoints behind a web application firewall rule that rejects requests with client-supplied price fields.
Require manual administrator approval for new accounts created through RegistrationMagic while the patch is being rolled out.

bash

# Update RegistrationMagic via WP-CLI
wp plugin update custom-registration-form-builder-with-submission-manager --version=6.0.9.9
wp plugin status custom-registration-form-builder-with-submission-manager