CVE-2026-77826
Received Received - Intake

RegistrationMagic WordPress Plugin Facebook Token Authentication Bypass

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-77826
EUVD
EUVD-2026-71848

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
registrationmagic registrationmagic to 6.0.9.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the RegistrationMagic WordPress plugin versions 5.0.1.8 through 6.0.9.8. It allows unauthenticated attackers to bypass authentication by exploiting a missing validation check on Facebook access tokens. The plugin fails to verify which application issued the token, enabling attackers to log in as existing users if they obtain their tokens or create new accounts even when registration is disabled.

Detection Guidance

Check if the RegistrationMagic plugin version is between 5.0.1.8 and 6.0.9.8. Use WordPress admin panel to inspect installed plugins or run: wp plugin list --name=registrationmagic. If vulnerable, update to version 6.0.9.9 or later.

Impact Analysis

Unauthenticated attackers could gain unauthorized access to user accounts or create new accounts without permission. This could lead to data breaches, account takeovers, or unauthorized actions within the WordPress site. Disabling Facebook login does not fully mitigate the issue.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Immediately update the RegistrationMagic plugin to version 6.0.9.9 or higher. Disabling Facebook login does not fully mitigate the issue. Monitor for unauthorized account creations or logins.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77826. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart