CVE-2026-15208

Name of the Vulnerable Software and Affected Versions RegistrationMagic versions prior to 6.0.9.5

Description An unauthenticated attacker can bypass payment requirements to finalize paid registrations without making a valid payment. The issue occurs because the server-side check only confirms that the PayPal capture status is COMPLETED, failing to verify the amount, currency, payee, invoice ID, custom payment key, or prior use against the registration being finalized. This allows for price manipulation by using a low-value completed capture for an expensive registration or replaying a single capture across multiple registrations since captures are not de-duplicated.

Recommendations Update RegistrationMagic to version 6.0.9.5 or later.