# CVE-2026-9242: RegistrationMagic WordPress plugin authentication bypass in PayPal IPN handler Source: https://junglewise.ai/threats/cve-2026-9242-registrationmagic-wordpress-plugin-authentication-bypass-in-paypal Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-06-27. Updated: 2026-06-27 License: CC BY 4.0 with a link back CVE-2026-9242 · Severity: medium · CVSS 5.3 · Published 2026-06-27 RegistrationMagic, a WordPress plugin used for creating custom registration forms and managing user payments, contains a security flaw in how it handles PayPal payment notifications. An unauthorized attacker can send a forged payment notification to trick the system into linking a payment record to a different user account, including administrator accounts. This could allow an attacker to bypass security controls and log in as any user on the site, potentially leading to a full site takeover. Technologies: [Metagauss RegistrationMagic](https://junglewise.ai/threats/technologies/registrationmagic). Vendors: [Metagauss](https://junglewise.ai/threats/vendors/metagauss). ## Quick answers **Is CVE-2026-9242 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9242 being exploited in the wild. **How severe is CVE-2026-9242?** Medium severity, with a CVSS score of 5.3, published 27 June 2026. **Which products and versions are affected?** Metagauss RegistrationMagic up to and including 6.0.8.6. **Is there a fix for CVE-2026-9242?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-9242 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-9242?** Check whether you run Metagauss RegistrationMagic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The vulnerability exists in the PayPal IPN `callback` handler, which is registered as a `nopriv` AJAX action without authentication or nonce requirements. The handler updates the payment log database with attacker-controlled POST data—specifically the `payment_status` and the `custom` field containing a `user_id`—before performing PayPal IPN validation. Because the database is updated before validation, the record remains 'poisoned' even if validation later fails. An unauthenticated attacker can exploit this by overwriting a payment log entry's `user_id` with a target ID and then visiting the success return URL with a valid security hash to obtain authentication cookies for the targeted account. ## Affected products - Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login up to and including 6.0.8.6 ## Timeline - 2026-06-27: advisory: NVD publication date ## References - [https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.1/includes/class_rm_utilities.php](https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.1/includes/class_rm_utilities.php) - [https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.1/public/class_rm_public.php](https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.1/public/class_rm_public.php) - [https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.1/services/class_rm_paypal_service.php](https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.1/services/class_rm_paypal_service.php) - [https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.1/services/class_rm_paypal_service.php](https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.1/services/class_rm_paypal_service.php) - [https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.4/includes/class_rm_utilities.php](https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.4/includes/class_rm_utilities.php) - [https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.4/public/class_rm_public.php](https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.4/public/class_rm_public.php) - [https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.4/services/class_rm_paypal_service.php](https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.4/services/class_rm_paypal_service.php) ## Related threats - [RegistrationMagic WordPress plugin IDOR in submission editing](https://junglewise.ai/threats/cve-2026-15257-registrationmagic-wordpress-plugin-idor-in-submission-editing) - [RegistrationMagic IDOR in front-end form submissions](https://junglewise.ai/threats/cve-2026-15255-registrationmagic-idor-in-front-end-form-submissions) - [Metagauss RegistrationMagic CSRF privilege escalation](https://junglewise.ai/threats/cve-2026-12158-metagauss-registrationmagic-csrf-privilege-escalation) - [RegistrationMagic authentication bypass in WordPress plugin](https://junglewise.ai/threats/cve-2026-49764-registrationmagic-authentication-bypass-in-wordpress-plugin)