CVE-2026-77793: Unknown Registrationmagic

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.

Affected products

• Unknown Registrationmagic: before 6.0.9.9 (fixed in 6.0.9.9)

Published 2026-09-02. Last modified 2026-09-03.