CVE-2026-9242

Name of the Vulnerable Software and Affected Versions RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login versions prior to 6.0.8.7

Description An authentication bypass exists due to insufficient verification of data authenticity. The PayPal IPN callback handler is registered as a nopriv AJAX action that lacks authentication or nonce requirements. The handler updates the payment log database row using attacker-controlled POST data, specifically the payment status and custom variables (which encodes the target user id), before PayPal IPN validation occurs. This allows the database to be poisoned even if validation fails. Unauthenticated attackers can authenticate as any WordPress user, including administrators, by submitting a forged IPN request to overwrite a payment log entry's user id and then visiting the success return URL with a valid security hash to obtain authentication cookies for the targeted account.

Recommendations Update to version 6.0.8.7 or later.