# RegistrationMagic <= 6.1.0.1 - Unauthenticated Payment Bypass via PayPal IPN Sandbox Verification

- **ID:** WPSEC-2026-0979
- **Plugin:** RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (`custom-registration-form-builder-with-submission-manager`), https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/
- **Affected versions:** all versions before 6.1.0.2
- **Fixed in:** 6.1.0.2 (Update to 6.1.0.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/custom-registration-form-builder-with-submission-manager
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0979/

## Description

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity via the PayPal IPN handler (rm_paypal_ipn AJAX action) in all versions up to, and including, 6.1.0.1. This is due to the validate_ipn() function letting the incoming 'test_ipn' parameter decide whether the notification is verified against PayPal's sandbox or live environment, even when the site is set to live mode. This makes it possible for unauthenticated attackers to have notifications for sandbox payments, which cost nothing, accepted as verified. Their pending PayPal registrations are then marked as completed and their accounts activated without a real payment.

## References

- https://wpsec.com/vuln/WPSEC-2026-0979/
- https://plugins.svn.wordpress.org/custom-registration-form-builder-with-submission-manager/tags/6.1.0.2/
- https://wordpress.org/plugins/custom-registration-form-builder-with-submission-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0979/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.