Description
The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthenticated users to complete a paid registration without paying and obtain an activated account.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | RegistrationMagic | < 6.0.9.9 | 6.0.9.9 |
References
- https://wpscan.com/vulnerability/83f11a27-be9c-4b27-b4ea-d0c58e0d7829/ exploit vdb-entry technical-description