WordPress Plugin Vulnerabilities

RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field

Description

The plugin does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.

Proof of Concept

Affects Plugins

Plugin icon
custom-registration-form-builder-with-submission-manager
Fixed in 6.0.9.9

References

CVE
CVE-2026-77793

Miscellaneous

Original Researcher
Charles Vosburgh
Submitter
Charles Vosburgh
Verified
Yes
WPVDB ID
83f11a27-be9c-4b27-b4ea-d0c58e0d7829

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 2 days ago)
Last Updated
2026-08-31 (about 2 days ago)

Other

Published
Title
Published
2026-03-27
Title
SureForms < 2.6.0 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
Published
2020-04-18
Title
Rank Math 0.9~1.0.42.1 - Authenticated Missing Access Controls to Disable Competitor Plugins
Published
2022-07-11
Title
YOP Poll < 6.4.3 - IP Spoofing
Published
2015-12-14
Title
Admin Management Xtended <= 2.4.0 - Privilege Escalation
Published
2015-07-13
Title
CP Image Store with Slideshow <= 1.0.6 - Purchase ID Brute Force Prevention