CVE-2026-77826highCWE-287

CVE-2026-77826: high-severity vulnerability in RegistrationMagic

RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

Published · Updated

Follow this CVE+ Monitor RegistrationMagic

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.8epss 0.4%
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · RegistrationMagic
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — RegistrationMagic

In the same product, most dangerous first.

CVE-2026-77792HIGHRegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating FieldEPSS 0.4%CVE-2024-9390MEDIUMRegistrationMagic < 6.0.2.1 - Stored XSSEPSS 0.3%CVE-2026-77794MEDIUMRegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero QuantityEPSS 0.3%CVE-2026-77793MEDIUMRegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price FieldEPSS 0.3%CVE-2026-15255MEDIUMRegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOREPSS 0.3%CVE-2026-15257MEDIUMRegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile ModificationEPSS 0.3%