CVE-2026-9242: RegistrationMagic WordPress plugin authentication bypass in PayPal IPN handler

CVE-2026-9242 · Severity: medium · CVSS 5.3 · Published 2026-06-27

RegistrationMagic, a WordPress plugin used for creating custom registration forms and managing user payments, contains a security flaw in how it handles PayPal payment notifications. An unauthorized attacker can send a forged payment notification to trick the system into linking a payment record to a different user account, including administrator accounts. This could allow an attacker to bypass security controls and log in as any user on the site, potentially leading to a full site takeover.

Technologies: Metagauss RegistrationMagic. Vendors: Metagauss.

Quick answers

Is CVE-2026-9242 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9242 being exploited in the wild.
How severe is CVE-2026-9242?
Medium severity, with a CVSS score of 5.3, published 27 June 2026.
Which products and versions are affected?
Metagauss RegistrationMagic up to and including 6.0.8.6.
Is there a fix for CVE-2026-9242?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9242 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9242?
Check whether you run Metagauss RegistrationMagic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the PayPal IPN `callback` handler, which is registered as a `nopriv` AJAX action without authentication or nonce requirements. The handler updates the payment log database with attacker-controlled POST data—specifically the `payment_status` and the `custom` field containing a `user_id`—before performing PayPal IPN validation. Because the database is updated before validation, the record remains 'poisoned' even if validation later fails. An unauthenticated attacker can exploit this by overwriting a payment log entry's `user_id` with a target ID and then visiting the success return URL with a valid security hash to obtain authentication cookies for the targeted account.

Affected products

  • Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login up to and including 6.0.8.6

Timeline

  • 2026-06-27: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.