A critical authentication flaw in the RegistrationMagic WordPress plugin allows unauthenticated attackers to hijack user sessions or register unauthorized accounts.

The vulnerability is caused by improper authentication (CWE-287) where the plugin fails to verify the recipient application of a Facebook access token. This allows an unauthenticated attacker to present a valid token obtained for a different application to the target site, effectively bypassing authentication mechanisms.

This vulnerability poses a severe risk to organizational data and user integrity. An attacker can gain full unauthorized access to existing user accounts, including administrative accounts if targeted, or circumvent registration restrictions to create new malicious accounts. Given the CVSS score of 8.8, this flaw represents a high risk for data exfiltration, unauthorized system changes, and total compromise of the plugin's identity management capabilities.

Immediate Action: Update the RegistrationMagic WordPress plugin to version 6.0.9.9 or later immediately to incorporate the required token validation checks.

Proactive Monitoring: Review application access logs for suspicious account creation patterns or unusual authentication spikes originating from external identity providers like Facebook.

Compensating Controls: If patching is delayed, consider disabling Facebook login integration within the RegistrationMagic settings to eliminate the vulnerable attack vector.

Public Exploit Available: No

The severity of this authentication bypass necessitates prompt action from all administrators utilizing the RegistrationMagic plugin. Because this vulnerability allows for complete account takeover, organizations must prioritize the update to version 6.0.9.9 to ensure the integrity of their user authentication process. Failure to patch leaves the platform open to significant security risks, including unauthorized access and potential administrative takeover.