The RegistrationMagic WordPress plugin fails to verify the audience attribute of a Facebook access token before accepting it as proof of identity. This omission lets an attacker who obtains a valid token log in as any existing user or create a new account even when user registration is disabled, effectively bypassing authentication controls. The result is full compromise of the target user accounts, including access to whatever permissions that user holds, and can lead to broader site compromise if the account is an administrator. The vulnerability is an instance of improper authentication (CWE‑287).

The vulnerability affects the RegistrationMagic WordPress plugin versions 5.0.1.8 through 6.0.9.8 inclusive. Versions 6.0.9.9 and later are believed to contain the fix (inferred from available statements).

Based on the description, the likely attack vector involves an attacker who has obtained a Facebook access token issued to an approved application. No EPSS score is provided and the issue is not listed in the CISA KEV catalog, yet the impact is high because the flaw permits credential impersonation without additional permissions. Once the token is in hand, it can be submitted to the plugin’s authentication endpoint to log in or create an account regardless of site registration settings. This makes the vulnerability exploitable in any WordPress environment running the affected plugin and exposes all sites that rely on Facebook login to potential account takeover.