CVE-2026-77794: CWE-472 External Control of Assumed-Immutable Web Parameter in RegistrationMagic

CVE-2026-77794 is a CWE-472 vulnerability in the RegistrationMagic WordPress plugin that arises from improper validation of a client-supplied quantity multiplier parameter used in calculating the total price of a paid registration. Because the plugin does not validate this parameter, unauthenticated users can exploit it to bypass payment and gain an activated account with the privileges granted by the registration form. The vulnerability affects version 6.0.0.0 of RegistrationMagic. There is no official patch or remediation level currently stated in the available data.

Exploitation of this vulnerability allows unauthenticated attackers to bypass payment controls and obtain activated accounts with roles assigned by the registration form. This could lead to unauthorized privilege escalation within the affected WordPress site. There is no indication of confidentiality or availability impact, but integrity is impacted due to unauthorized account activation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the registration functionality or implement additional validation controls to prevent manipulation of the quantity multiplier parameter.