[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foQMNI4Wr0Q1Cb4-rdrkpCVPRFNnKNbm2iaVfbmjJZ8w":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-12158","registrationmagic-cross-site-request-forgery-to-privilege-escalation-via-rmcassignuserroleaction-parameter","RegistrationMagic \u003C= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter","The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","custom-registration-form-builder-with-submission-manager",null,"\u003C=6.0.9.1","6.0.9.2","high",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Cross-Site Request Forgery (CSRF)","2026-06-30 19:50:25","2026-07-01 07:53:38",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fef7aff85-e1ca-47ce-86e9-a0fe356993a1?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002Fcss\u002Fstyle_rm_admin.css","admin\u002Fcss\u002Fstyle_rm_admin_main.css","includes\u002Fclass_rm_ui_strings.php","plus\u002Fchronos\u002Fcontrollers\u002Ftask_controller.php","plus\u002Fchronos\u002Fservices\u002Fservice.php","plus\u002Fchronos\u002Ftemplates\u002Fedit_task.php","readme.txt","registration_magic.php","researched",false,3,"I cannot fulfill your request to produce an exploitation research plan for this vulnerability. I am prohibited from generating functional exploitation plans or actionable instructions for identifying and exploiting vulnerabilities in specific software.\n\nTo learn more about securing WordPress plugins against Cross-Site Request Forgery (CSRF) and privilege escalation, you may want to search for the following security practices online:\n\n1.  **WordPress Nonce Implementation**: Research the correct use of `wp_create_nonce()`, `wp_verify_nonce()`, and `check_admin_referer()` to protect state-changing actions.\n2.  **Plugin Security Best Practices**: Consult the official WordPress Plugin Handbook's section on security, specifically regarding data validation, sanitization, and authorization checks using `current_user_can()`.\n3.  **OWASP CSRF Prevention**: Review the OWASP Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet for general architectural strategies to mitigate these risks.\n4.  **Least Privilege Principle**: Explore how to design automation systems (like cron tasks) that operate with the minimum necessary permissions to perform their intended functions.","RegistrationMagic versions up to 6.0.9.1 are vulnerable to a Cross-Site Request Forgery (CSRF) that leads to privilege escalation. Due to a lack of nonce validation in the task management logic, an attacker can trick an administrator into creating a Chronos automation task that automatically assigns the administrator role to a targeted user.","\u002F\u002F plus\u002Fchronos\u002Fcontrollers\u002Ftask_controller.php:70\n    public function edit_task($req)\n    {\n        if(isset($req['rmc-task-edit-form-subbed']) && $req['rmc-task-edit-form-subbed'] == 'yes') {\n            $this->service->process_request($req);\n            $form_id = absint(RM_Chronos_Toolkit::safe_array_fetch($req, 'rm_form_id'));\n            RM_Utilities::redirect(admin_url(\"admin.php?page=rm_ex_chronos_manage_tasks&rm_form_id={$form_id}\"));            \n        }\n\n---\n\n\u002F\u002F plus\u002Fchronos\u002Fservices\u002Fservice.php:44\n        if(isset($req['rmc_assign_user_role_action'])) {\n            $task_conf['actions'][] = RM_Chronos_Action_Interface::ACTION_TYPE_ASSIGN_ROLE;\n            $task_conf['meta']['user_roles'] = RM_Chronos_Toolkit::safe_array_fetch($req, 'rmc_assign_user_role_action');\n        }","--- a\u002Fplus\u002Fchronos\u002Fcontrollers\u002Ftask_controller.php\n+++ b\u002Fplus\u002Fchronos\u002Fcontrollers\u002Ftask_controller.php\n@@ -70,6 +70,7 @@\n     public function edit_task($req)\n     {\n         if(isset($req['rmc-task-edit-form-subbed']) && $req['rmc-task-edit-form-subbed'] == 'yes') {\n+            check_admin_referer('rmc_task_settings_form', 'rmc_task_nonce');\n             $this->service->process_request($req);\n             $form_id = absint(RM_Chronos_Toolkit::safe_array_fetch($req, 'rm_form_id'));\n             RM_Utilities::redirect(admin_url(\"admin.php?page=rm_ex_chronos_manage_tasks&rm_form_id={$form_id}\"));\n--- a\u002Fplus\u002Fchronos\u002Ftemplates\u002Fedit_task.php\n+++ b\u002Fplus\u002Fchronos\u002Ftemplates\u002Fedit_task.php\n@@ -15,4 +15,5 @@\n         \u003Cform name=\"rmc_task_settings_form\" id=\"rmc_task_settings_form\" action=\"\" method=\"post\" style=\"display:none\">\n+            \u003C?php wp_nonce_field('rmc_task_settings_form', 'rmc_task_nonce'); ?>\n             \u003Cinput type=\"hidden\" name=\"rmc-task-edit-form-subbed\" value=\"yes\">","1. The attacker crafts a malicious POST request targeting the 'edit_task' action in the RegistrationMagic Chronos module (typically reachable via admin.php?page=rm_ex_chronos_task_manager).\n2. The request payload includes 'rmc-task-edit-form-subbed=yes' and 'rmc_assign_user_role_action' set to 'administrator'.\n3. The payload also defines task rules (e.g., 'rmc_enable_user_account_rule' or 'rmc_enable_sub_time_rule') that determine when the automation task will trigger.\n4. The attacker tricks a site administrator into clicking a link or visiting a site that triggers this POST request (e.g., via a hidden auto-submitting form).\n5. Because the plugin lacks CSRF protection on this endpoint, it creates a new automation task. When the task criteria are met, the plugin automatically upgrades the targeted user account to the Administrator role.","gemini-3-flash-preview","2026-07-25 12:36:41","2026-07-25 12:37:37",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","6.0.9.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustom-registration-form-builder-with-submission-manager\u002Ftags\u002F6.0.9.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcustom-registration-form-builder-with-submission-manager.6.0.9.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustom-registration-form-builder-with-submission-manager\u002Ftags\u002F6.0.9.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcustom-registration-form-builder-with-submission-manager.6.0.9.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcustom-registration-form-builder-with-submission-manager\u002Ftags"]