CVE-2026-12158: RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the processrequest function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RegistrationMagic – User Registration Forms Plugin (WordPress)to a version that resolves this vulnerability.Fixed in 6.0.9.1 - Compensating control
Ensure WordPress cron/automation task execution cannot be triggered via forged requests; restrict or harden any mechanism that allows Chronos automation tasks to be executed through WordPress cron so that unauthenticated attackers cannot exploit nonce-missing CSRF to escalate privileges.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12158?
The severity of CVE-2026-12158 is rated high with a score of 8.8.
What type of vulnerability is CVE-2026-12158?
CVE-2026-12158 is a Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2026-12158?
To fix CVE-2026-12158, upgrade the RegistrationMagic plugin to version 6.0.9.2 or later that includes proper nonce validation.
What impact does CVE-2026-12158 have on my website?
CVE-2026-12158 can lead to privilege escalation, allowing unauthenticated attackers to perform unauthorized actions on your WordPress site.
Which versions of the RegistrationMagic plugin are affected by CVE-2026-12158?
All versions of the RegistrationMagic plugin up to and including 6.0.9.1 are affected by CVE-2026-12158.