CVE-2026-12158

Name of the Vulnerable Software and Affected Versions RegistrationMagic – User Registration Forms Plugin versions prior to 6.0.9.2

Description This issue involves a Cross-Site Request Forgery (CSRF) flaw, which occurs when a web application fails to verify that a request was intentionally initiated by the user. The flaw exists in the process request() function due to missing or incorrect nonce validation. An unauthenticated attacker can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to escalate the privileges of a form submitter to administrator by creating a malicious Chronos automation task executed via WordPress cron.

Recommendations Update RegistrationMagic – User Registration Forms Plugin to version 6.0.9.2 or later. As a temporary mitigation, restrict access to the process request() function to prevent unauthorized requests.