CVE-2026-15208 describes an insufficient verification of data authenticity (CWE-345) in the RegistrationMagic WordPress plugin prior to version 6.0.9.5. The plugin's server-side logic for finalizing registrations based on PayPal payment captures only confirms that the capture status is COMPLETED, without validating the capture's amount, currency, payee, or checking for reuse of the capture. This flaw enables an unauthenticated attacker to finalize expensive paid registrations using any genuinely completed low-value PayPal capture and to reuse a single capture multiple times because there is no de-duplication mechanism.

The vulnerability allows an unauthenticated attacker to bypass payment verification by using low-value completed PayPal captures to finalize paid registrations. This can lead to financial loss for the site owner as attackers can register multiple times without paying the correct amount. There is no impact on confidentiality or availability reported. The CVSS score is 5.3 (medium severity) with no confidentiality or availability impact, only integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider disabling the affected payment verification feature or implementing additional server-side validation to verify payment details such as amount, currency, payee, and to prevent reuse of payment captures.