5.3
Moyenne
CVE-2026-77794 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when…
Description
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid registration, allowing unauthenticated users to register without paying and obtain an activated account holding the role the form grants.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| RegistrationMagic 6.0 | 6.0.0.0 → < 6.0.9.9 | 6.0.9.9 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de RegistrationMagic
Les 11 CVE de RegistrationMagic →
CVE-2026-77826
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was…
8.8
Élevée
CVE-2026-77793
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration…
5.3
Moyenne
CVE-2026-77792
The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting…
7.5
Élevée
CVE-2026-77790
The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL…
5.5
Moyenne