Vulnerability · Published Aug 6, 2026 · Assigned by WPScan

CVE-2026-15208RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification

Medium 5.3

In plain English

A medium-severity insufficient verification of data authenticity in RegistrationMagic from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 94.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.

Affected products (as reported)

Vendor	Product	Versions
Unknown	RegistrationMagic	0 – before 6.0.9.5

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/b8c75098-41a9-4b24-9f6b-c3144f230cd8/ exploit, vdb-entry, technical-description