The CVE describes a flaw in the RegistrationMagic WordPress plugin where the server fails to verify the total price for paid registrations. An attacker can omit the price field and cause the plugin to accept the request as fully paid, creating an activated account without any financial transaction. This bypass allows unauthenticated users to obtain privileged access without payment, potentially leading to unauthorized usage, increased operational costs, and cloud resource consumption.

The vulnerability is present in all installations of the RegistrationMagic WordPress plugin older than version 6.0.9.9. The affected vendor is unknown but the plugin is commonly used in WordPress sites for managing event registrations and membership sign‑ups.

The CVSS score of 5.3 indicates a moderate risk, and the EPSS score is not available, implying the exploitation probability is unclear. The vulnerability is unauthenticated and relies on a simple HTTP request to the registration endpoint; no special privileges or advanced techniques are required. Because it is not listed in CISA KEV, no active exploit is currently known, but the ease of triggering the bypass makes it a likely target for automated account creation or fraudulent activity.