Junglewise Threat Intelligence

CVE-2026-9242: RegistrationMagic WordPress plugin authentication bypass in PayPal IPN handler

CVE-2026-9242 · Severity: medium · CVSS 5.3 · Published 2026-06-27

Technologies: Metagauss RegistrationMagic. Vendors: Metagauss.

Executive brief

RegistrationMagic, a WordPress plugin used for creating custom registration forms and managing user payments, contains a security flaw in how it handles PayPal payment notifications. An unauthorized attacker can send a forged payment notification to trick the system into linking a payment record to a different user account, including administrator accounts. This could allow an attacker to bypass security controls and log in as any user on the site, potentially leading to a full site takeover.

Technical details

The vulnerability exists in the PayPal IPN `callback` handler, which is registered as a `nopriv` AJAX action without authentication or nonce requirements. The handler updates the payment log database with attacker-controlled POST data—specifically the `payment_status` and the `custom` field containing a `user_id`—before performing PayPal IPN validation. Because the database is updated before validation, the record remains 'poisoned' even if validation later fails. An unauthenticated attacker can exploit this by overwriting a payment log entry's `user_id` with a target ID and then visiting the success return URL with a valid security hash to obtain authentication cookies for the targeted account.

Affected products

  • Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login up to and including 6.0.8.6

Timeline

  • 2026-06-27: advisory: NVD publication date

References

Related threats