CyberRota Analysis
AI-GeneratedThe RegistrationMagic WordPress plugin prior to version 6.0.9.9 is vulnerable due to inadequate verification of Facebook access tokens, enabling unauthenticated attackers to either log in as existing users or create new accounts, even with user registration disabled. This flaw poses a significant security risk, particularly for sites relying on Facebook for user authentication. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential unauthorized access.
Original NVD Description
The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.