Authentication Bypass in RegistrationMagic WordPress Plugin

Executive Summary

This vulnerability exists in the RegistrationMagic WordPress plugin, which handles custom registration forms, user registration, payment, and user login. The issue is an authentication bypass caused by insufficient verification of data authenticity in the PayPal IPN callback handler.

Specifically, the PayPal IPN callback handler is registered as a no-privilege AJAX action without requiring authentication or a nonce. It updates the payment log database with attacker-controlled POST data, including payment status and a custom field encoding the target user ID, before validating the PayPal IPN.

Because the database is updated before validation, an attacker can submit a forged IPN request that overwrites a payment log entry's user ID with that of any target user, including administrators. Then, by visiting the success return URL with a valid security hash, the plugin issues real WordPress authentication cookies for the targeted account, effectively allowing the attacker to authenticate as that user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to bypass authentication and gain access to any WordPress user account, including administrator accounts.

By exploiting this flaw, attackers can take over user accounts, potentially leading to unauthorized access to sensitive information, modification of website content, or control over the entire WordPress site.

Since the attacker can impersonate legitimate users, this can result in significant security breaches, data integrity issues, and loss of trust in the affected website.

Useful 0 Not Useful 0