The RegistrationMagic WordPress plugin contains a critical authentication bypass vulnerability that allows unauthenticated attackers to compromise user accounts.

This vulnerability is an authentication bypass flaw categorized under CWE-288. It occurs because the software fails to properly validate credentials through an alternate path, allowing unauthenticated remote attackers to potentially gain unauthorized access to the system.

This flaw carries a CVSS score of 7.4, which classifies it as a high severity risk. Successful exploitation could lead to full unauthorized access to user accounts, resulting in the compromise of sensitive personal information, potential data theft, and loss of administrative control over the plugin settings.

Immediate Action: Update the RegistrationMagic plugin to version 6.0.9.9 or later immediately to resolve the authentication flaw.

Proactive Monitoring: Review web server access logs for unusual patterns or repeated failed login attempts that deviate from standard user behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting the RegistrationMagic endpoint until the patch can be applied.

Public Exploit Available: exploit_available (false)

Given the high CVSS score and the potential for complete authentication bypass, this vulnerability represents a significant security risk to any site utilizing the RegistrationMagic plugin. Administrators should prioritize updating to the latest version to eliminate this exposure and prevent potential account hijacking.