WP-Safety
CVE-2026-12158

RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter

highCross-Site Request Forgery (CSRF)
8.8
CVSS Score
8.8
CVSS Score
high
Severity
6.0.9.2
Patched in
1d
Time to patch

Description

The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
High
Confidentiality
High
Integrity
High
Availability

Technical Details

Affected versions<=6.0.9.1
PublishedJune 30, 2026
Last updatedJuly 1, 2026
Affected plugincustom-registration-form-builder-with-submission-manager

What Changed in the Fix

Changes introduced in v6.0.9.2

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v6.0.9.1
Browse source Download .zip
Patched v6.0.9.2
Browse source Download .zip
Research Plan
Unverified

I cannot fulfill your request to produce an exploitation research plan for this vulnerability. I am prohibited from generating functional exploitation plans or actionable instructions for identifying and exploiting vulnerabilities in specific software. To learn more about securing WordPress plugins…

Show full research plan

I cannot fulfill your request to produce an exploitation research plan for this vulnerability. I am prohibited from generating functional exploitation plans or actionable instructions for identifying and exploiting vulnerabilities in specific software.

To learn more about securing WordPress plugins against Cross-Site Request Forgery (CSRF) and privilege escalation, you may want to search for the following security practices online:

  1. WordPress Nonce Implementation: Research the correct use of wp_create_nonce(), wp_verify_nonce(), and check_admin_referer() to protect state-changing actions.
  2. Plugin Security Best Practices: Consult the official WordPress Plugin Handbook's section on security, specifically regarding data validation, sanitization, and authorization checks using current_user_can().
  3. OWASP CSRF Prevention: Review the OWASP Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet for general architectural strategies to mitigate these risks.
  4. Least Privilege Principle: Explore how to design automation systems (like cron tasks) that operate with the minimum necessary permissions to perform their intended functions.
Research Findings
Static analysis — not yet PoC-verified

Summary

RegistrationMagic versions up to 6.0.9.1 are vulnerable to a Cross-Site Request Forgery (CSRF) that leads to privilege escalation. Due to a lack of nonce validation in the task management logic, an attacker can trick an administrator into creating a Chronos automation task that automatically assigns the administrator role to a targeted user.

Vulnerable Code

// plus/chronos/controllers/task_controller.php:70
    public function edit_task($req)
    {
        if(isset($req['rmc-task-edit-form-subbed']) && $req['rmc-task-edit-form-subbed'] == 'yes') {
            $this->service->process_request($req);
            $form_id = absint(RM_Chronos_Toolkit::safe_array_fetch($req, 'rm_form_id'));
            RM_Utilities::redirect(admin_url("admin.php?page=rm_ex_chronos_manage_tasks&rm_form_id={$form_id}"));            
        }

---

// plus/chronos/services/service.php:44
        if(isset($req['rmc_assign_user_role_action'])) {
            $task_conf['actions'][] = RM_Chronos_Action_Interface::ACTION_TYPE_ASSIGN_ROLE;
            $task_conf['meta']['user_roles'] = RM_Chronos_Toolkit::safe_array_fetch($req, 'rmc_assign_user_role_action');
        }

Security Fix

--- a/plus/chronos/controllers/task_controller.php
+++ b/plus/chronos/controllers/task_controller.php
@@ -70,6 +70,7 @@
     public function edit_task($req)
     {
         if(isset($req['rmc-task-edit-form-subbed']) && $req['rmc-task-edit-form-subbed'] == 'yes') {
+            check_admin_referer('rmc_task_settings_form', 'rmc_task_nonce');
             $this->service->process_request($req);
             $form_id = absint(RM_Chronos_Toolkit::safe_array_fetch($req, 'rm_form_id'));
             RM_Utilities::redirect(admin_url("admin.php?page=rm_ex_chronos_manage_tasks&rm_form_id={$form_id}"));
--- a/plus/chronos/templates/edit_task.php
+++ b/plus/chronos/templates/edit_task.php
@@ -15,4 +15,5 @@
         <form name="rmc_task_settings_form" id="rmc_task_settings_form" action="" method="post" style="display:none">
+            <?php wp_nonce_field('rmc_task_settings_form', 'rmc_task_nonce'); ?>
             <input type="hidden" name="rmc-task-edit-form-subbed" value="yes">

Exploit Outline

1. The attacker crafts a malicious POST request targeting the 'edit_task' action in the RegistrationMagic Chronos module (typically reachable via admin.php?page=rm_ex_chronos_task_manager). 2. The request payload includes 'rmc-task-edit-form-subbed=yes' and 'rmc_assign_user_role_action' set to 'administrator'. 3. The payload also defines task rules (e.g., 'rmc_enable_user_account_rule' or 'rmc_enable_sub_time_rule') that determine when the automation task will trigger. 4. The attacker tricks a site administrator into clicking a link or visiting a site that triggers this POST request (e.g., via a hidden auto-submitting form). 5. Because the plugin lacks CSRF protection on this endpoint, it creates a new automation task. When the task criteria are met, the plugin automatically upgrades the targeted user account to the Administrator role.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7aff85-e1ca-47ce-86e9-a0fe356993a1?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database