CVE-2026-77826 Overview
CVE-2026-77826 is an authentication bypass vulnerability in the RegistrationMagic WordPress plugin before version 6.0.9.9. The plugin accepts Facebook access tokens as proof of identity without verifying which application issued the token. Unauthenticated attackers can log in as any existing user whose Facebook access token they obtain. Attackers can also create and log into new accounts even when user registration is disabled on the target site. The flaw is classified under [CWE-287: Improper Authentication].
Critical Impact
Unauthenticated attackers can impersonate arbitrary users or provision new accounts on affected WordPress sites, bypassing registration restrictions and gaining site access.
Affected Products
- RegistrationMagic WordPress plugin versions prior to 6.0.9.9
- WordPress sites using Facebook login integration provided by RegistrationMagic
- Any WordPress deployment with the vulnerable plugin activated
Discovery Timeline
- 2026-09-05 - CVE-2026-77826 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-77826
Vulnerability Analysis
The RegistrationMagic plugin implements Facebook social login by exchanging a Facebook access token for a local WordPress session. The plugin trusts the token contents to identify the user without validating the token's origin application. This missing validation step converts a standard OAuth trust boundary into an open authentication channel. An attacker who possesses any valid Facebook access token tied to a target user can present it to the plugin and receive an authenticated session for that user's WordPress account.
The issue also allows account provisioning even when the site administrator has disabled user registration. Because the plugin creates accounts through its Facebook flow rather than the standard WordPress registration path, the administrative control is bypassed entirely.
Root Cause
The root cause is the absence of an app_id verification step when processing Facebook access tokens. Facebook access tokens are scoped to the application that issued them, and legitimate integrations must call the Graph API debug_token endpoint to confirm the token was issued to the expected application. RegistrationMagic omits this check, so tokens issued to any Facebook application are accepted as valid identity proof.
Attack Vector
Exploitation requires network access to the WordPress site and a Facebook access token that references the target user. Attackers can obtain such tokens through unrelated Facebook applications they operate, phishing pages that request Facebook login, or malicious mobile apps. The attacker submits the token to the plugin's Facebook login endpoint and receives an authenticated WordPress session cookie. See the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-77826
Indicators of Compromise
- Successful logins through the RegistrationMagic Facebook authentication endpoint from IP addresses that do not match the user's normal geolocation or device fingerprint.
- New WordPress user accounts created via the plugin's Facebook flow while the site's general registration setting is disabled.
- Session cookies issued to users who have no prior history of using Facebook login on the site.
Detection Strategies
- Review WordPress access logs for POST requests to RegistrationMagic AJAX endpoints handling Facebook login, correlating them with the resulting wp_set_auth_cookie events.
- Compare the Facebook application ID recorded in plugin logs (if available) against the site's configured Facebook application; mismatches indicate exploitation.
- Audit the wp_users table for accounts created after plugin installation whose registration source is Facebook but whose email domains or metadata are anomalous.
Monitoring Recommendations
- Enable verbose logging on the plugin's authentication handlers and forward events to a centralized SIEM for correlation.
- Alert on privileged role assignments (administrator, editor) applied to accounts originating from social login flows.
- Monitor for sudden spikes in Facebook-authenticated session creation, which may indicate scripted abuse.
How to Mitigate CVE-2026-77826
Immediate Actions Required
- Update the RegistrationMagic plugin to version 6.0.9.9 or later on all WordPress sites.
- Invalidate existing WordPress sessions and force password resets for accounts that used Facebook login on vulnerable versions.
- Audit user accounts created since plugin installation and remove unauthorized accounts, especially those with elevated roles.
Patch Information
The vendor has released RegistrationMagic version 6.0.9.9, which adds application verification for Facebook access tokens. Site owners should upgrade through the WordPress plugin manager or by replacing the plugin files with the fixed release. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the RegistrationMagic plugin until the update to 6.0.9.9 can be applied.
- Disable the Facebook social login option within the plugin configuration while retaining other registration methods.
- Restrict access to the plugin's authentication endpoints at the web server or web application firewall layer until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
