CVE-2026-77826: RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RegistrationMagic (WordPress plugin)to a version that resolves this vulnerability.Fixed in 6.0.9.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using RegistrationMagic versions before 6.0.9.9 are affected. An attacker can target an existing user if they obtain that user's Facebook access token, or create and access a new account even when site registration is disabled.
What does an attacker need to exploit the bypass?
The attacker needs a Facebook access token they can present to the plugin. Because the plugin does not validate the application audience for the token, it may accept a token not issued for the site's Facebook application.
Does disabling WordPress user registration prevent exploitation?
No. The issue allows an attacker to create and log into a new account even when user registration is disabled.