PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-77793 RegistrationMagic CVE debrief

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account. This vulnerability, with a CVSS score of 5.3 and medium severity, affects administrators and users of the plugin. The CVE record was published on 2026-09-02T15:17:39.543Z. Further review of official records and vendor remediation is recommended.

Vendor
RegistrationMagic
Product
RegistrationMagic WordPress plugin
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-02
Original CVE updated
2026-09-03
Advisory published
2026-09-02
Advisory updated
2026-09-03

Who should care

Administrators and users of the RegistrationMagic WordPress plugin should review and apply patches to prevent potential unauthorized account creation. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impact on their systems. Operators of WordPress sites using the RegistrationMagic plugin should also take note of this vulnerability and take necessary precautions to protect their sites.

Technical summary

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account. This vulnerability has a CVSS score of 5.3 and a medium severity. It affects the RegistrationMagic plugin, which is used for managing registrations on WordPress sites. The vulnerability allows for unauthorized account creation, which could lead to potential security risks.

Defensive priority

Medium-priority defensive review recommended due to potential for unauthorized account creation.

Recommended defensive actions

  • Review and apply vendor patches for RegistrationMagic WordPress plugin version 6.0.9.9 or later.
  • Monitor for suspicious registration activity and implement compensating controls.
  • Verify inventory of installed plugins and ensure proper configuration.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE description indicates that the RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account. Evidence is limited; further review of official records and vendor remediation is recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-77793 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-77793

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-77793 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-77793

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.