The RegistrationMagic WordPress plugin prior to 6.0.9.5 fails to compare the PayPal capture details with the registration being finalized. It only checks that the capture status is COMPLETED. Because of this oversight, an unauthenticated attacker can trigger the completion of an expensive paid registration using any low‑value capture that has already been completed, and the same capture can be replayed across multiple registrations due to the lack of deduplication. This represents a CWE‑284 (Improper Access Control) and CWE‑396 (Missing or Incorrect Validation) weakness, leading to unauthorized payment processing, potentially draining the site’s funds without legitimate transaction amounts, and creating a financial loss for the site owner. The CVSS score of 5.3 indicates a moderate severity and the lack of an EPSS score or KEV listing suggests no widespread exploitation has been documented yet, but the vulnerability remains exploitable through simple unauthenticated requests.

RegistrationMagic WordPress plugin versions earlier than 6.0.9.5. The CNAs list the affected vendor as Unknown:RegistrationMagic, and no other vendors or products are reported.

The vulnerability can be exploited by any user who can access the registration endpoint without authentication. No special privileges are required once a capture record exists. The CVSS base score is 5.3, reflecting moderate exploitation difficulty but a meaningful impact. Because EPSS is not available and the CVE is not listed in CISA’s KEV catalog, the risk is considered moderate but not yet widely observed. The attack vector is web‑based, parasitic on the PayPal payment flow, and does not require direct control over the PayPal system, making exploitation practically feasible.