Executive brief
RegistrationMagic is a WordPress plugin that allows website administrators to create user registration forms with paid membership options. An unauthenticated attacker can bypass payment validation and activate a free account without paying by omitting or zeroing out price fields in the registration request, immediately gaining access to premium features intended only for paying customers.
Technical details
RegistrationMagic fails to validate the total price of paid registrations on the server side, relying instead on client-side price parameters that an attacker can freely manipulate. The vulnerability affects the plugin's payment processing logic when handling Price fields in registration forms. An unauthenticated attacker can submit a registration request with the quantity set to 0 or the price field omitted entirely, causing the plugin to record the transaction as "Completed" for $0.00 while still activating the user account. No payment gateway communication occurs in these cases. The vulnerability was fixed in version 6.0.9.9; versions up to 6.0.9.8 are affected.
Affected products
- RegistrationMagic RegistrationMagic before 6.0.9.9
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Version 6.0.9.9 released with server-side price validation