What’s Vulnerable › Vulnerabilities
CVE-2026-15208: RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-06 · updated 2026-08-26
- Weakness: CWE-345
Description
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.
Affected products
- Metagauss RegistrationMagic: before 6.0.9.5 — fixed in 6.0.9.5
How to fix
Upgrade to a fixed version: Metagauss RegistrationMagic 6.0.9.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-15208 or the next vulnerability affects your stack