Executive brief
RegistrationMagic is a WordPress plugin that allows users to register and log in using their Facebook accounts. The plugin fails to validate that a Facebook access token belongs to the correct application before accepting it for login, allowing attackers to forge login credentials or create accounts even when registration is disabled, leading to unauthorized account access and identity spoofing.
Technical details
This is an authentication bypass vulnerability in the Facebook single sign-on (SSO) integration. The root cause is the missing verification of the "audience" claim in Facebook access tokens before accepting them as proof of identity. Attackers can obtain a Facebook access token (from any source) and use it to log in as an existing user or create a new account without a valid invitation, bypassing both registration restrictions and the Facebook login button setting. The vulnerability requires network access to the WordPress login endpoint and no prior authentication, but an attacker must possess or be able to obtain a valid Facebook token. The plugin was patched in version 6.0.9.9.
Affected products
- RegistrationMagic RegistrationMagic 5.0.1.8 through 6.0.9.8
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 6.0.9.9