CVE-2026-9242 describes an authentication bypass vulnerability in the RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login WordPress plugin up to version 6.0.8.6. The vulnerability arises because the PayPal IPN callback handler is registered as a no-privilege AJAX action without authentication or nonce protection. Critically, the handler updates the payment log database with attacker-supplied POST data, including the payment status and a custom field encoding the target user ID, before performing PayPal IPN validation. This results in a poisoned database state even if validation later fails. An attacker can exploit this by submitting a forged IPN request that overwrites a payment log entry's user ID with that of a target account, then visiting the success return URL with a valid security hash to receive legitimate WordPress authentication cookies for that user.

The vulnerability allows unauthenticated attackers to bypass authentication and impersonate any WordPress user, including administrators. This can lead to unauthorized access to the WordPress site with elevated privileges. The CVSS score of 5.3 (medium severity) reflects the network attack vector, low attack complexity, no privileges required, and no user interaction needed, with impact limited to integrity (unauthorized modification of data) but no confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the AJAX endpoint if possible and monitor for suspicious IPN callback activity. Avoid relying on the plugin's IPN handling for authentication. Follow vendor updates closely for an official fix.