CVE-2025-14444 is a vulnerability in the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login WordPress plugin by metagauss. The issue arises from insufficient verification of data authenticity (CWE-345) in the 'process_paypal_sdk_payment' function, where the plugin accepts client-supplied payment status without confirming the payment with PayPal. This allows attackers to bypass payment requirements and activate accounts fraudulently. The vulnerability affects all versions up to 6.0.6.9. There is no vendor advisory or patch information available to confirm remediation status.

An attacker can bypass the payment process by manipulating client-side data, resulting in unauthorized activation of paid registrations without completing actual PayPal payments. This leads to loss of revenue and potential abuse of the registration system. The vulnerability does not impact confidentiality or availability directly but affects the integrity of the payment verification process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the affected payment functionality or implementing additional server-side verification of PayPal transactions to prevent payment bypass.