Facebook Token Validation Bypass in WordPress Registration

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new account even when user registration is disabled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-77826 represents a critical authentication bypass vulnerability in the RegistrationMagic WordPress plugin that fails to validate which application issued a Facebook access token before accepting it for user authentication. This flaw allows attackers to authenticate as existing users by obtaining their Facebook tokens through various means, or to create unauthorized accounts even when registration is explicitly disabled by site administrators. Any WordPress installation using RegistrationMagic before version 6.0.9.9 with Facebook login enabled is vulnerable, potentially affecting thousands of websites that rely on social authentication for user onboarding and access control.

Casky.ai's 283 mapped security skills detect the attack patterns underlying this vulnerability by analyzing MITRE ATT&CK technique TA0004 (Privilege Escalation) and TA0006 (Credential Access). When practitioners run threat detection using Claude's extended reasoning across these skills, they'll identify suspicious authentication anomalies: unexpected login success from new IP addresses using Facebook tokens, account creation events when registration should be disabled, and token reuse patterns that indicate stolen credentials being leveraged. The platform surfaces CWE-287 (Improper Authentication) findings showing how attackers bypass application-level token verification, enabling security teams to correlate these signals and recognize the characteristic signature of Facebook token misuse before accounts are compromised at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77826.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-77826

Casky has 283 skills that investigate the attack patterns behind CVE-2026-77826. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn