CVE-2026-9242: WordPress RegistrationMagic Auth Bypass

CVE-2026-9242 Overview

CVE-2026-9242 is an authentication bypass vulnerability in the RegistrationMagic WordPress plugin, affecting all versions up to and including 6.0.8.6. The flaw resides in the PayPal Instant Payment Notification (IPN) callback handler, which is registered as an unauthenticated AJAX action without nonce verification. The handler updates payment log database records with attacker-controlled POST data before PayPal IPN validation runs. Unauthenticated attackers can forge an IPN request to overwrite a payment log entry's user_id field with any target account, including administrators. By then visiting the plugin's success return URL, the attacker triggers issuance of legitimate WordPress authentication cookies for the impersonated account [CWE-345].

Critical Impact
Unauthenticated attackers can authenticate as arbitrary WordPress users, including administrators, by poisoning payment log entries through a forged PayPal IPN request.

Affected Products

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (WordPress plugin)
All versions up to and including 6.0.8.6
Plugin slug: custom-registration-form-builder-with-submission-manager

Discovery Timeline

2026-06-27 - CVE-2026-9242 published to the National Vulnerability Database (NVD)
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-9242

Vulnerability Analysis

The vulnerability originates in the plugin's PayPal IPN callback handler defined in class_rm_paypal_service.php. The handler is registered as a nopriv AJAX endpoint, meaning WordPress executes it without requiring authentication or a valid nonce. Any anonymous HTTP client on the network can reach it.

The critical design flaw is ordering. The handler writes attacker-controlled POST parameters, including payment_status and the custom field encoding user_id, directly into the payment log database row before contacting PayPal to validate the IPN. If validation later fails, the poisoned row is not rolled back. The database remains in the attacker's chosen state.

Once a payment log entry references a target user_id, the attacker visits the plugin's success return URL with a security hash obtained through a legitimate low-privilege payment flow. The plugin then issues real WordPress authentication cookies bound to the poisoned user_id, granting session access to the targeted account.

Root Cause

The root cause is insufficient verification of data authenticity [CWE-345]. Trust decisions are based on unauthenticated POST input, and state-changing database writes occur before the external authenticity check against PayPal completes. There is no transactional rollback, no origin validation, and no binding between the security hash and the identity encoded in the payment log row.

Attack Vector

The attack is remote and unauthenticated over the network. An attacker submits a crafted POST request to the plugin's PayPal IPN AJAX action, supplying a known payment_log identifier along with a custom field that maps to the target user's ID. The handler updates the row, PayPal validation fails silently, and the poisoned row persists. The attacker then requests the plugin's success return URL with a valid security hash to receive authentication cookies for the target account. No user interaction is required.

For exploitation details, see the Wordfence Threat Intelligence Report and the vulnerable code in the PayPal Service handler.

Detection Methods for CVE-2026-9242

Indicators of Compromise

Unauthenticated POST requests to admin-ajax.php with action=rm_paypal_ipn or the plugin's IPN callback action, especially from non-PayPal source IPs.
Payment log rows in the plugin's database table whose user_id values reference administrator or high-privilege accounts that never initiated a paid registration.
Authentication cookies issued from the plugin's success return URL shortly after an IPN callback from an unexpected origin.
New administrator logins from IP addresses that recently issued POST traffic to the PayPal IPN endpoint.

Detection Strategies

Monitor WordPress access logs for POST requests to admin-ajax.php referencing the RegistrationMagic PayPal IPN action from sources outside PayPal's published IP ranges.
Inspect the plugin's payment log table for rows where the user_id field was modified after creation without a corresponding successful transaction.
Correlate IPN callback events with subsequent hits to the plugin's success return URL and unexpected wordpress_logged_in_* cookie issuance.

Monitoring Recommendations

Alert on privileged WordPress account logins that were not preceded by a successful wp-login.php authentication event.
Track and baseline traffic to the plugin's IPN handler; flag spikes or requests carrying custom fields that decode to administrator user IDs.
Retain web server and PHP error logs long enough to reconstruct IPN request sequences and identify hash reuse patterns.

How to Mitigate CVE-2026-9242

Immediate Actions Required

Update the RegistrationMagic plugin to the patched release beyond version 6.0.8.6 as soon as the vendor publishes it, per the WordPress plugin changeset.
Audit all WordPress administrator and editor accounts for unauthorized logins, session tokens, or password changes.
Invalidate active sessions by rotating AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values in wp-config.php.
Review the plugin's payment log table for tampered user_id values and remove suspicious rows.

Patch Information

The vendor addressed the issue in a release following version 6.0.8.6. The fix moves database writes to occur only after successful PayPal IPN validation and adds authenticity checks binding the security hash to the payment log entry. Refer to the Wordfence advisory for patched version details and the plugin changeset for the code change.

Workarounds

Temporarily deactivate the RegistrationMagic plugin until an upgrade can be applied if PayPal payment flows are not business-critical.
Block or rate-limit POST requests to admin-ajax.php where action matches the plugin's PayPal IPN handler at the web application firewall (WAF), allowing only PayPal's documented IPN source ranges.
Restrict access to the plugin's success return URL to authenticated sessions or trusted networks using server-level rewrite rules.

bash

# Example nginx rule to restrict PayPal IPN callback to PayPal's IP ranges
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "rm_paypal_ipn") {
        # Allow only PayPal IPN source ranges (update per PayPal documentation)
        allow 173.0.80.0/20;
        allow 64.4.240.0/21;
        deny all;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}