VulnerabilityDeferred

CVE-2026-15208

An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.

MEDIUM 5.3EPSS 0.13%

Does this matter?

Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.

Description

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.13% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-345
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/b8c75098-41a9-4b24-9f6b-c3144f230cd8/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.