The vulnerability resides in the RegistrationMagic WordPress plugin, allowing an attacker to bypass authentication by forging a PayPal IPN request. The plugin registers a nopriv AJAX callback that processes payment data before verifying its authenticity, enabling attackers to inject arbitrary values, including payment status and a custom field containing a target user_id. By controlling these POST parameters, an unauthenticated attacker can overwrite a payment log entry linked to a privileged account and force the plugin to issue legitimate WordPress authentication cookies for that account. This circumvents normal login checks and grants the attacker the same privileges as the targeted user. The flaw involves the CWE-345 weakness of insufficient authentication of transmitted data.

The flaw affects all users of the RegistrationMagic plugin for WordPress up to and including version 6.0.8.6. The plugin provides custom registration forms, user registration, payment handling, and user login functionality. The vulnerability is specific to the PayPal IPN callback in these versions; newer releases beyond 6.0.8.6 are not covered by this advisory.

The CVSS score of 5.3 indicates a moderate severity. Because the vulnerability requires the attacker to know or guess a valid PayPal IPN signature to pass validation, the exploitability is limited; however, the lack of prior authentication or nonce allows the attacker to conduct the initial request without credentials. The EPSS score is unavailable, making it unclear how frequently this types of attacks may be attempted. Since the flaw is not listed in the CISA KEV catalog, it may not yet have known exploits in the wild. Nevertheless, once the initial forged request succeeds, the attacker obtains full control of the target account immediately. The attack vector likely involves HTTP POST requests to the plugin's AJAX endpoint, potentially spoofing PayPal’s IPN payload and secret, and then triggering the return URL to generate authentication cookies.