RegistrationMagic <= 6.1.0.1 - Unauthenticated Payment Bypass via PayPal IPN Sandbox Verification
- ID
- WPSEC-2026-0979
- Plugin
- RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (custom-registration-form-builder-with-submission-manager)
- Affected
- all versions before 6.1.0.2
- Remediation
- Update to 6.1.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- RegistrationMagic on WPSec AttackSurface
- Fix released
- Published
Description
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the PayPal IPN handler (rm_paypal_ipn AJAX action) in all versions up to, and including, 6.1.0.1. This is due to the validate_ipn() function letting the incoming 'test_ipn' parameter decide whether the notification is verified against PayPal's sandbox or live environment, even when the site is set to live mode. This makes it possible for unauthenticated attackers to have notifications for sandbox payments, which cost nothing, accepted as verified. Their pending PayPal registrations are then marked as completed and their accounts activated without a real payment.
References
- https://wpsec.com/vuln/WPSEC-2026-0979/
- https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.2/
- https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS