CVE-2026-77826

Name of the Vulnerable Software and Affected Versions RegistrationMagic WordPress plugin versions prior to 6.0.9.9

Description The plugin fails to verify the application to which a Facebook access token was issued before accepting it as proof of identity. This allows unauthenticated attackers to log in as an existing user if they obtain a valid token, or to create and access a new account even if user registration is disabled.

Recommendations Update RegistrationMagic WordPress plugin to version 6.0.9.9 or later.