CVE-2026-77826

RegistrationMagic before 6.0.9.9 accepts a Facebook access token as proof of identity without verifying that the token was issued to the site's own Facebook application, an improper authentication flaw (CWE-287). An unauthenticated attacker who obtains any valid Facebook access token can present it to the plugin and be treated as an authenticated Facebook user, because the issuing application is never checked. The attacker can log in as an existing WordPress user whose token they can obtain (an act the CVSS user-interaction metric suggests typically requires that user's involvement, e.g. via a phishing or malicious app), or create and log into a new account even when user registration is disabled on the site. Any WordPress site running an affected version of RegistrationMagic with Facebook-based login enabled is affected. No exploitation has been reported: there is no known public PoC, the issue is not in CISA KEV, and EPSS puts the 30-day exploitation probability at just 0.3%.

What to do: Update RegistrationMagic to version 6.0.9.9 or later. If immediate updating is not possible, disable the Facebook login/registration option in the plugin settings as a stopgap mitigation. Administrators should also review accounts created or logged into via Facebook authentication for unexpected or unauthorized activity.