CVE-2026-77794 Overview
CVE-2026-77794 is a business logic flaw in the RegistrationMagic WordPress plugin before version 6.0.9.9. The plugin fails to validate a client-supplied quantity multiplier when computing the total price of a paid registration. An unauthenticated attacker can manipulate this value to reduce the amount owed and complete registration without paying. The registration process still activates the account and assigns the role configured in the form. The issue is tracked under CWE-472: External Control of Assumed-Immutable Web Parameter.
Critical Impact
Unauthenticated attackers can bypass payment on paid registration forms and obtain active accounts with the role granted by the form, undermining monetization and access control.
Affected Products
- RegistrationMagic WordPress plugin versions prior to 6.0.9.9
- WordPress sites using RegistrationMagic paid registration forms
- Any site relying on RegistrationMagic for role assignment on payment
Discovery Timeline
- 2026-09-02 - CVE-2026-77794 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77794
Vulnerability Analysis
The RegistrationMagic plugin allows administrators to charge users during registration and grant a WordPress role upon successful payment. When calculating the order total, the plugin trusts a quantity multiplier submitted by the client without server-side validation. Attackers can substitute the value with 0, a negative number, or a decimal fraction to drive the computed price to zero or a nominal amount. The plugin then treats the registration as paid and provisions an active account with the form's configured role. Because the flaw resides in price calculation logic rather than authentication, the attack requires no credentials and no user interaction.
Root Cause
The root cause is a business logic error classified as [CWE-472]. The plugin treats a value that must be authoritative on the server as an untrusted client parameter. Price computation should derive quantity from server-side product state, not from the HTTP request body.
Attack Vector
Exploitation occurs over the network against the plugin's registration submission endpoint. An attacker intercepts or crafts the registration form POST and modifies the quantity multiplier field before submission. The server computes an incorrect total, records payment as satisfied, and activates the account with the role defined by the form. See the WPScan Vulnerability Advisory for technical details.
Detection Methods for CVE-2026-77794
Indicators of Compromise
- Newly created WordPress user accounts with assigned roles but no corresponding successful payment gateway transaction.
- Registration order records showing totals of 0, negative values, or fractional amounts inconsistent with configured product pricing.
- Requests to RegistrationMagic submission endpoints containing unusual quantity, multiplier, or item count parameter values.
Detection Strategies
- Reconcile RegistrationMagic order logs against payment processor records to identify accounts activated without matching charges.
- Audit the WordPress wp_users and wp_usermeta tables for accounts created through paid forms with elevated roles but no order confirmation.
- Inspect web server access logs for POST requests to registration endpoints containing manipulated numeric parameters.
Monitoring Recommendations
- Enable verbose logging on the RegistrationMagic plugin and forward events to a centralized log platform for correlation.
- Alert on any registration granting a role above subscriber that is not matched by a completed payment gateway callback.
- Track and rate-limit repeated registration submissions from single IP addresses targeting paid forms.
How to Mitigate CVE-2026-77794
Immediate Actions Required
- Update the RegistrationMagic plugin to version 6.0.9.9 or later on all WordPress sites.
- Review all accounts created since the vulnerable version was deployed and disable any provisioned without valid payment.
- Rotate credentials and revoke sessions for accounts suspected of exploiting the flaw.
Patch Information
Upgrade RegistrationMagic to version 6.0.9.9 or later, which validates the quantity multiplier server-side. Refer to the WPScan Vulnerability Advisory for the fixed release information.
Workarounds
- Temporarily disable paid registration forms in RegistrationMagic until the plugin is updated.
- Restrict registration endpoints behind a web application firewall rule that rejects requests with non-positive integer quantity values.
- Manually approve new accounts created through paid forms and verify payment gateway confirmation before activation.
# Configuration example
wp plugin update custom-registration-form-builder-with-submission-manager --version=6.0.9.9
wp user list --role=subscriber --format=csv > registration_audit.csv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
