CVE-2026-15208: Unknown Registrationmagic

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.

Affected products

• Unknown Registrationmagic: before 6.0.9.5 (fixed in 6.0.9.5)

Published 2026-08-06. Last modified 2026-08-26.