Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-77793

RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field

Description

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown RegistrationMagic

Default version status: unaffected

  • 0 to < 6.0.9.9affected

References