# CVE-2026-77794: RegistrationMagic payment bypass via unvalidated quantity multiplier

Source: https://junglewise.ai/threats/cve-2026-77794-registrationmagic-payment-bypass-via-unvalidated-quantity  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77794 · Severity: medium · CVSS 5.3 · Published 2026-09-02

RegistrationMagic is a WordPress plugin that allows website owners to create paid registration forms. The plugin fails to validate user-supplied quantity values when calculating registration fees, enabling unauthenticated attackers to register for paid accounts by setting the quantity to zero, bypassing payment requirements and receiving full account activation with assigned roles.

## Quick answers

**Is CVE-2026-77794 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77794 being exploited in the wild.

**How severe is CVE-2026-77794?** Medium severity, with a CVSS score of 5.3, published 2 September 2026.

**Which products and versions are affected?** RegistrationMagic RegistrationMagic 6.0.0.0 to 6.0.9.8.

**Is there a fix for CVE-2026-77794?** A patch was published on 2026-09-02: Fixed in version 6.0.9.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77794 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77794?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a client-side price calculation bypass in the RegistrationMagic plugin's paid registration form handler. When processing a registration submission, the plugin accepts a quantity multiplier parameter (appended with "_qty" to the price field name) without validation, allowing attackers to set it to zero or other values that evaluate to zero. This causes the total price to become zero, bypassing the PayPal payment gateway entirely. The attack requires no authentication, valid nonce, or user interaction—only knowledge of the form's internal field names. An attacker can craft a POST request with the quantity set to 0 to create an active, fully-privileged account without making payment.

## Affected products

- RegistrationMagic RegistrationMagic 6.0.0.0 to 6.0.9.8

## Timeline

- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 6.0.9.9

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/c8cdc20f-d6ca-4e02-b8ab-68cd9362952f/](https://wpscan.com/vulnerability/c8cdc20f-d6ca-4e02-b8ab-68cd9362952f/)