CVE-2026-77794: Unknown Registrationmagic

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants.

Affected products

• Unknown Registrationmagic: from 6.0.0.0, before 6.0.9.9 (fixed in 6.0.9.9)

Published 2026-09-02. Last modified 2026-09-03.