{
 "id": "WPSEC-2026-0979",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0979/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0979/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0979/index.md",
 "title": "RegistrationMagic <= 6.1.0.1 - Unauthenticated Payment Bypass via PayPal IPN Sandbox Verification",
 "description": "The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the PayPal IPN handler (rm_paypal_ipn AJAX action) in all versions up to, and including, 6.1.0.1. This is due to the validate_ipn() function letting the incoming 'test_ipn' parameter decide whether the notification is verified against PayPal's sandbox or live environment, even when the site is set to live mode. This makes it possible for unauthenticated attackers to have notifications for sandbox payments, which cost nothing, accepted as verified. Their pending PayPal registrations are then marked as completed and their accounts activated without a real payment.",
 "plugin": {
  "slug": "custom-registration-form-builder-with-submission-manager",
  "name": "RegistrationMagic",
  "full_name": "RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login",
  "wordpress_org": "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/custom-registration-form-builder-with-submission-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.1.0.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.1.0.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.1.0.2",
 "remediation": "Update to 6.1.0.2 or later.",
 "fix_released": "2026-10-14T07:43:53+00:00",
 "published": "2026-10-15T08:49:41+00:00",
 "updated": "2026-10-14T14:17:57.285785+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0979/",
  "https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.2/",
  "https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}