metagauss RegistrationMagic Plugin up to 6.0.8.6 on WordPress User Registration custom data authenticity

Summaryinfo

A vulnerability was found in metagauss RegistrationMagic Plugin up to 6.0.8.6 on WordPress. It has been declared as critical. This affects an unknown part of the component User Registration Handler. Executing a manipulation of the argument custom can lead to data authenticity. The identification of this vulnerability is CVE-2026-9242. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in metagauss RegistrationMagic Plugin up to 6.0.8.6 on WordPress. This vulnerability affects some unknown processing of the component User Registration Handler. The manipulation of the argument custom with an unknown input leads to a data authenticity vulnerability. The CWE definition for the vulnerability is CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN `callback` handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data — including `payment_status` and the `custom` field encoding the target `user_id` — before PayPal IPN validation is performed, meaning the database remains poisoned even when validation subsequently fails. This makes it possible for unauthenticated attackers to authenticate as any WordPress user, including administrators, by submitting a forged IPN request that overwrites a payment log entry's `user_id` with that of a target account, then visiting the success return URL with a legitimately obtained security hash to cause the plugin to issue real WordPress authentication cookies for the targeted account.

The weakness was shared by Rafael Gunawan. The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-9242 since 05/21/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

Upgrading to version 6.0.8.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-39949). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Vendor

• metagauss

Name

• RegistrationMagic Plugin

Version

• 6.0.8.0
• 6.0.8.1
• 6.0.8.2
• 6.0.8.3
• 6.0.8.4
• 6.0.8.5
• 6.0.8.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion