The vulnerability resides in the RegistrationMagic plugin’s process_paypal_sdk_payment function, where client‑supplied payment data is accepted without verification against PayPal’s records. Because the payment status is not validated on the server side, an attacker can forge the transaction parameters and complete a registration without actually completing a PayPal payment. This flaw is classified as CWE‑345 and represents a failure to ensure the authenticity of payment information, leading to a full compromise of the paid‑registration workflow.

All WordPress sites running the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin in versions 6.0.6.7 through 6.0.6.9 are affected. The plugin is distributed by metagauss and is widely deployed for custom registration and payment handling in WordPress environments. Sites that expose the process_paypal_sdk_payment endpoint to anonymous users are at direct risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation attempts are currently rare, and the vulnerability is not listed in CISA’s KEV catalog. However, the likely attack vector is an unauthenticated HTTP request to the process_paypal_sdk_payment endpoint, where an attacker supplies forged payment parameters. If successful, the attacker can gain access to paid registration features without authorizing a real PayPal transaction, fully undermining the site’s payment integrity.