CVE-2025-14444 - CVE House
Back to Database
Status published Medium CVE-2025-14444

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment

Vulnerability Description

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to payment bypass due to insufficient verification of data authenticity on the 'process_paypal_sdk_payment' function in all versions up to, and including, 6.0.6.9. This is due to the plugin trusting client-supplied values for payment verification without validating that the payment actually went through PayPal. This makes it possible for unauthenticated attackers to bypass paid registration by manipulating payment status and activating their account without completing a real PayPal payment.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14444

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Md. Moniruzzaman Prodhan

References

More from metagauss

View All →
CVE-2025-6977
ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function
Medium 6.1
CVE-2025-6586
Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload
High 7.2
CVE-2025-2836
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium 6.4
CVE-2025-1408
ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management
Medium 4.3
CVE-2025-15403
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
Critical 9.8

Affected Vendor

Affected Software

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Vulnerable Versions:
0

Timeline

Official Publish: February 18th, 2026
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-345

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1071 Application Layer Protocol
Command and Control
T1552 Unsecured Credentials
Credential Access
T1190 Exploit Public-Facing Application
Initial Access
T1041 Exfiltration Over C2 Channel
Exfiltration