CVE-2026-15208 in RegistrationMagic's PayPal handler is being scored as CVSS 5.3, which badly misrepresents the actual risk. This is not a configuration gap — it's a fundamental architectural failure where the plugin treats PayPal's 'COMPLETED' status return as authorization proof, when it's actually just a status flag that says money changed hands somewhere.
The vulnerability: the plugin accepts a COMPLETED signal without verifying that the capture corresponds to the specific registration being finalized, for the correct amount, in the correct currency. There's no idempotency check — the same PayPal capture can finalize unlimited registrations once. An attacker needs only a single legitimate low-value PayPal transaction and access to any registration form using this plugin. The attack ceiling is bounded only by registration volume, not attacker resources.
The minimum viable fix requires four checks: match the amount, match the currency, match the recipient (merchant account), and deduplicate on the transaction ID. Without all four, you're patching the symptom rather than the design flaw.
Whether version 6.0.9.5 implements this correctly is the critical question. The patch must do more than add transaction ID tracking — it needs to enforce amount matching at the database query level, verifying that the captured amount corresponds to the specific registration being completed. If it only addresses the replay vector without solving the amount-verification gap, the architectural vulnerability persists.
For defenders: check whether your registration forms use this plugin and are running 6.0.9.5 or later. Beyond patching, treat this as a signal to audit any payment handlers in your plugin ecosystem for the same pattern — status-as-authorization is a known bad pattern that circulates in boilerplate code across WordPress plugins. The fix archaeology question matters: if the developer patched this instance without replacing the underlying template, the same vulnerability will resurface in the next plugin that borrows this code.