High severity · published Sep 5, 2026
CVE-2026-77826
RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
RegistrationMagic ·
5.0.1.8 before 6.0.9.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77826
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77826
wpscan.com
https://wpscan.com/vulnerability/b79a83e8-d7b0-4aa8-b2ba-37a7eecd437b/
More from RegistrationMagic
7.5
CVE-2026-77792
RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field
5.5
CVE-2026-77790
RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter
5.3
CVE-2026-77794
RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
5.3
CVE-2026-77793
RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field
5.3
CVE-2026-15208
RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification