CVE-2026-15208 describes an insufficient verification of data authenticity (CWE-345) in the RegistrationMagic WordPress plugin prior to version 6.0.9.5. The plugin's server-side logic for finalizing registrations based on PayPal payments only confirms that the payment capture status is COMPLETED. It does not verify that the payment amount, currency, payee, or whether the capture has been previously used matches the registration being finalized. This flaw enables unauthenticated attackers to finalize paid registrations fraudulently by reusing any valid low-value PayPal capture multiple times.

The vulnerability allows attackers to bypass payment verification and finalize paid registrations without paying the correct amount. This can lead to financial loss for the site owner due to unauthorized registrations being accepted. There is no impact on confidentiality or availability reported, but the integrity of payment processing is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected payment finalization feature or implementing additional server-side validation to verify payment details such as amount, currency, payee, and uniqueness of payment captures. Monitor vendor communications for an official fix.