CVE-2026-77826

8.8 Élevée

Publiée le 05/09/2026 à 09:17 · Modifiée le 08/09/2026 à 21:09 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.

Traduire en français

Produits concernés

Unknown RegistrationMagic

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-287

Références

https://wpscan.com/vulnerability/b79a83e8-d7b0-4aa8-b2ba-37a7eecd437b/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories