Threats tagged 'ghsa-x5h9-fc29-gm85'

RegistrationMagic WordPress plugin versions before 6.0.9.5 have a vulnerability where the server-side verification of PayPal payment captures only checks if the capture status is COMPLETED. It does not verify the amount, currency, payee, or whether the capture has been previously used. This allows an unauthenticated attacker to finalize paid registrations using low-value completed captures and replay a single capture across multiple registrations.