CVE-2026-77826 in RegistrationMagic Plugin
Summary
by MITRE • 09/05/2026
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 represents a critical failure in authentication logic related to third-party social login integrations. Specifically, the flaw resides within the OAuth2 flow implementation for Facebook logins. When a user attempts to authenticate via their Facebook account, the application receives an access token from Facebook's servers as proof of identity. However, the plugin fails to validate that this specific access token was issued exclusively to the RegistrationMagic application itself. In standard OAuth2 implementations, it is imperative that the client verifies the audience claim or app ID associated with the received token to ensure it matches the expected recipient. By omitting this verification step, the system accepts any valid Facebook access token regardless of its intended destination. This oversight fundamentally breaks the trust model established by the OpenID Connect and OAuth2 standards, allowing tokens generated for other applications to be misinterpreted as legitimate credentials for the vulnerable WordPress site.
The operational impact of this vulnerability is severe due to the nature of social login mechanisms in web applications. An unauthenticated attacker can exploit this flaw by obtaining a valid Facebook access token through various means, such as phishing attacks targeting users or intercepting tokens from other compromised services that use similar authentication flows. Once an attacker possesses a valid token for any application on the same user's Facebook account, they can present it to the vulnerable RegistrationMagic plugin. The system will accept this token and authenticate the attacker as the corresponding Facebook user within the WordPress environment. This capability allows attackers to bypass all standard login barriers without needing passwords or multi-factor authentication codes associated with the target accounts. Furthermore, if the site permits new registrations via social logins, an attacker can create a completely new administrative account using their own controlled Facebook identity and gain immediate access to the backend of the website.
This vulnerability directly facilitates unauthorized access and potential privilege escalation within the affected WordPress installation. If the targeted user holds any role with elevated privileges, such as Administrator or Editor, the attacker gains full control over the site's content, settings, and potentially server-level configurations depending on how those roles are mapped to system permissions. Even if registration is disabled for new users, existing accounts remain vulnerable to takeover. This scenario aligns closely with CWE-287, which describes Improper Authentication, specifically where an actor is able to bypass or manipulate authentication mechanisms by exploiting flaws in token validation logic. The attack vector also correlates with MITRE ATT&CK technique T1078, Valid Accounts, as the adversary leverages legitimate credentials obtained from external sources to gain unauthorized access to internal systems.
To mitigate this vulnerability, administrators must upgrade the RegistrationMagic plugin to version 6.0.9.9 or later, where the issue has been addressed by implementing strict validation of the token's audience claim against the application ID registered with Facebook. Until an update is applied, site owners should consider disabling social login features entirely if they are not strictly necessary for their user base. Additionally, enforcing strong password policies and multi-factor authentication for all administrative accounts can provide a secondary layer of defense, although it does not fully remediate the underlying flaw in the OAuth implementation. Regular security audits of third-party plugins that handle external identity providers are essential to ensure compliance with modern authentication standards and prevent similar misconfigurations from leading to account compromise.