CVE-2026-9242: RegistrationMagic WordPress Plugin Authentication Bypass via PayPal IPN Handler

Technical summary

CVE-2026-9242 exploits improper sequencing in the PayPal IPN callback handler within RegistrationMagic. The handler is registered as a nopriv AJAX action—meaning it accepts unauthenticated requests—with no nonce validation. The critical flaw is that attacker-controlled POST data (specifically `payment_status` and the `custom` field containing the target `user_id`) is written to the payment log database *before* PayPal IPN validation occurs. Even when PayPal validation subsequently fails, the database row remains corrupted. An attacker can exploit this by submitting a malformed IPN request that overwrites the `user_id` field in an existing payment log entry, then visiting the legitimate success return URL with a valid security hash to trigger the issuance of authentication cookies for the compromised user account. The root cause is CWE-345 (Insufficient Verification of Data Authenticity), compounded by reversed trust boundaries and database writes prior to validation.

Business impact

Successful exploitation grants an attacker the ability to assume any user identity on a WordPress site running RegistrationMagic. Admin account takeover is possible, enabling wholesale site defacement, data exfiltration, installation of backdoors, and lateral movement into connected systems. For sites using RegistrationMagic for membership or payment processing, this creates direct fraud and compliance risk. Affected organizations may face customer notification obligations, temporary site suspension during remediation, and reputational harm.

Affected systems

All versions of the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress up to and including version 6.0.8.6 are vulnerable. Organizations using this plugin should assume exposure regardless of site visibility or traffic level; the vulnerability requires no special network positioning and is accessible to any remote, unauthenticated attacker. Verify your installed version immediately.

Exploitability

Exploitability is high. The attack requires no user interaction, no authentication, and only network access to the WordPress site. The attacker does not need to know a target user's password or intercept legitimate PayPal traffic. The only prerequisite is knowledge of the target `user_id` (typically sequential and easily enumerated in WordPress). A simple HTTP POST request to the nopriv AJAX handler combined with a subsequent legitimate visit completes the compromise. No special tools or advanced techniques are required, making this suitable for automated scanning and exploitation at scale.

Remediation

Update RegistrationMagic to a patched version released after 2026-06-29. Verify the patch version number against the vendor's official security advisory. If an immediate patch is unavailable, disable the PayPal IPN callback handler or restrict access to the AJAX endpoint via web application firewall rules. As a temporary measure, block POST requests to the vulnerable callback endpoint at your WAF or reverse proxy. Perform a post-remediation audit of user account creation and login logs to identify any unauthorized access.

Patch guidance

Check the RegistrationMagic plugin repository and the vendor's official advisory for version 6.0.8.7 or later. WordPress site administrators should enable automatic plugin updates or check for available updates within the WordPress admin dashboard. After patching, clear any locally cached plugin files to ensure the new code is loaded. Test login and PayPal payment functionality on a staging environment before deploying to production.

Detection guidance

Monitor web server logs and WAF logs for POST requests to `/wp-admin/admin-ajax.php` with `action=rm_paypal_ipn_callback` (or similar PayPal callback endpoint parameters) originating from unexpected sources or at unusual frequencies. Hunt for payment log database entries where `payment_status` or `user_id` values appear corrupted or inconsistent with corresponding PayPal transaction records. Review WordPress authentication logs for successful logins immediately following PayPal IPN callback requests, especially for admin accounts with no associated password reset. Enable detailed logging of the PayPal IPN handler if available via debug settings.

Why prioritize this

Despite the MEDIUM CVSS score, this vulnerability merits HIGH or CRITICAL priority for RegistrationMagic users because: (1) it enables complete account takeover including admin accounts with zero authentication, (2) exploitability is trivial and requires no user interaction, (3) it threatens the integrity and confidentiality of customer data and payment records, and (4) remediation is straightforward (a patch) but impact is severe until applied. Organizations with membership, payment, or high-privilege user bases should patch immediately.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects low attack complexity and network accessibility without authentication, but is capped by the integrity impact (I:L) and lack of confidentiality or availability impact in the base vector. However, the contextual risk is substantially higher: the ability to assume any user identity—including administrators—on a WordPress site is functionally equivalent to remote code execution or data exfiltration in practice. Organizations should apply greater weight to business context (payment systems, user data sensitivity) than to the numerical score alone.

Frequently asked questions