Registrationmagic

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:registrationmagic:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorUnknown (668ca391-a6cc-5e33-879b-83885214de33)
ProductRegistrationmagic (fc16bd82-454d-5d79-848f-27f8f9fbf84a)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-15257 vulnerable 2026-09-16 04:33:06.915753 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification
The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator WordPress accounts.
Published: 2026-07-30T06:00:09.359Z
Updated: 2026-07-30T15:00:10.130Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-15208 vulnerable 2026-09-16 04:33:06.888115 RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification
MEDIUM (5.3)
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.
Published: 2026-08-06T17:07:32.014Z
Updated: 2026-08-07T14:11:53.346Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-15255 vulnerable 2026-09-16 04:33:06.261397 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR
The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data, including personal information.
Published: 2026-07-30T06:00:09.191Z
Updated: 2026-07-30T15:02:30.668Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-77826 vulnerable 2026-09-16 04:32:40.940741 RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.
Published: 2026-09-05T06:00:05.130Z
Updated: 2026-09-06T10:41:21.425Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-0929 vulnerable 2026-06-08 07:47:13.502092 RegistrationMagic < 6.0.7.2 - Subscriber+ Form Creation
The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
Published: 2026-02-16T06:00:01.611Z
Updated: 2026-02-17T18:22:21.617Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-15520 vulnerable 2026-06-08 07:06:36.383834 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-9390 vulnerable 2026-06-08 07:00:27.237002 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.