Executive brief
RegistrationMagic is a WordPress plugin that allows website owners to create paid registration forms. The plugin fails to validate user-supplied quantity values when calculating registration fees, enabling unauthenticated attackers to register for paid accounts by setting the quantity to zero, bypassing payment requirements and receiving full account activation with assigned roles.
Technical details
The vulnerability is a client-side price calculation bypass in the RegistrationMagic plugin's paid registration form handler. When processing a registration submission, the plugin accepts a quantity multiplier parameter (appended with "_qty" to the price field name) without validation, allowing attackers to set it to zero or other values that evaluate to zero. This causes the total price to become zero, bypassing the PayPal payment gateway entirely. The attack requires no authentication, valid nonce, or user interaction—only knowledge of the form's internal field names. An attacker can craft a POST request with the quantity set to 0 to create an active, fully-privileged account without making payment.
Affected products
- RegistrationMagic RegistrationMagic 6.0.0.0 to 6.0.9.8
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 6.0.9.9