Rafael Gunawan

**Name of the Vulnerable Software and Affected Versions** RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login versions prior to 6.0.8.7 **Description** An authentication bypass exists due to insufficient verification of data authenticity. The PayPal IPN `callback` handler is registered as a nopriv AJAX action that lacks authentication or nonce requirements. The handler updates the payment log database row using attacker-controlled POST data, specifically the `payment status` and `custom` variables (which encodes the target `user id`), before PayPal IPN validation occurs. This allows the database to be poisoned even if validation fails. Unauthenticated attackers can authenticate as any WordPress user, including administrators, by submitting a forged IPN request to overwrite a payment log entry's `user id` and then visiting the success return URL with a valid security hash to obtain authentication cookies for the targeted account. **Recommendations** Update to version 6.0.8.7 or later.