CVE-2026-15208 RegistrationMagic CVE debrief

Who should care

Administrators of WordPress sites using the RegistrationMagic plugin should review and update their installations to prevent potential unauthorized registration finalization. They should also monitor for suspicious registration activity and consider compensating controls such as IP blocking or rate limiting for registration attempts. Additionally, security teams and vulnerability management teams should be aware of the potential impact and review the affected plugin versions and configurations to ensure proper mitigation and remediation efforts are in place to prevent exploitation of this vulnerability in their environments and supply chains. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should also consider the potential financial loss through unauthorized registration finalization and prioritize accordingly. Security teams should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Security teams should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also check relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should also track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also consider compensating controls such as IP blocking or rate limiting for registration attempts. Security teams should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should also review the affected product context, defensive impact, and source-grounded technical framing without unsupported root-cause or exploit claims. This is

Technical summary

The RegistrationMagic WordPress plugin before 6.0.9.5 does not properly validate PayPal captures, allowing an unauthenticated attacker to finalize registrations using completed low-value captures. This is due to the server-side check only confirming the capture status is COMPLETED, without comparing the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising.

Defensive priority

Medium priority due to potential financial loss through unauthorized registration finalization.

Recommended defensive actions

• Review and update the RegistrationMagic plugin to version 6.0.9.5 or later.
• Implement additional monitoring for suspicious registration activity.
• Consider compensating controls such as IP blocking or rate limiting for registration attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Evidence from WPScan indicates a vulnerability in the RegistrationMagic WordPress plugin. Official CVE and NVD records provide additional context. The vulnerability allows an unauthenticated attacker to finalize registrations using completed low-value captures. WPScan and CVE records confirm the issue. Defenders should verify affected plugin versions, review capture validation, and monitor for suspicious activity.

Official resources