CVE-2026-15208
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Aug 06, 2026
Vendor
unknown
Description
The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.