Improper Payment Verification in RegistrationMagic WordPress Plugin

CVE-2026-15208

What is CVE-2026-15208?

The RegistrationMagic plugin for WordPress, prior to version 6.0.9.5, has a significant security flaw that undermines its payment verification process. The plugin fails to verify critical payment details—such as the amount, currency, payee, and prior usage—against the registration it is finalizing. As a result, an unauthenticated attacker can exploit this weakness by finalizing a high-value registration using merely a legitimate low-value payment capture, as long as the payment status is marked as COMPLETED. Furthermore, there is no mechanism to de-duplicate payment captures, allowing the same capture to be reused for multiple registrations without any checks in place.

References