RegistrationMagic CSRF提权漏洞CVE-2026-12158分析与修复

漏洞概述 漏洞名称: RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter CVE ID: CVE-2026-12158 CVSS评分: 8.8 (High) 发布日期: June 30, 2026 最后更新日期: July 1, 2026 研究人员: Chloe Chamberland - Wordfence PRISM 影响范围 软件类型: Plugin 软件名称: RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login 受影响版本: <= 6.0.9.1 修复版本: 6.0.9.2 修复方案 修复方法: 升级到版本 6.0.9.2 或更新的已修复版本。 其他信息 漏洞描述: RegistrationMagic - User Registration Forms Plugin 插件在 WordPress 的所有版本中（包括 6.0.9.1）存在跨站请求伪造（CSRF）漏洞。由于缺少或不正确的 nonce 验证，攻击者可以以管理员身份提交任意表单，从而提升权限。 参考链接: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org 近期相关漏洞 RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request - CVE ID: CVE-2026-9742 - CVSS评分: 5.3 - 研究人员: Rafael Gunawan (kokon) - 发布日期: June 26, 2026 RegistrationMagic - User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization - CVE ID: CVE-2026-49764 - CVSS评分: 5.3 - 研究人员: James Pareman - 发布日期: June 4, 2026 RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization - CVE ID: CVE-2026-32498 - CVSS评分: 5.3 - 研究人员: Supaklad S. (m3er) - 发布日期: March 20, 2026 RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass - CVE ID: CVE-2026-24373 - CVSS评分: 9.8 - 研究人员: 0x04fd5d3 - 发布日期: March 12, 2026 RegistrationMagic <= 6.0.7.6 - Missing Authorization - CVE ID: CVE-2026-32385 - CVSS评分: 4.3 - 研究人员: Supaklad S. (m3er) - 发布日期: February 18, 2026 RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.5.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment - CVE ID: CVE-2025-14444 - CVSS评分: 5.3 - 研究人员: Md. Moniruzzaman Prodhon (NomanProdhon) - 发布日期: February 17, 2026 RegistrationMagic <= 6.0.7.2 - Missing Authorization - CVE ID: CVE-2026-0929 - CVSS评分: 4.3 - 研究人员: Maktoum (bRpsd) - 发布日期: February 16, 2026 RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification - CVE ID: CVE-2026-1054 - CVSS评分: 5.3 - 研究人员: Md. Moniruzzaman Prodhon (NomanProdhon) - 发布日期: January 27, 2026 RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure - CVE ID: CVE-2025-15520 - CVSS评分: 5.3 - 研究人员: Maktoum (bRpsd) - 发布日期: January 23, 2026 RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order - CVE ID: CVE-2025-15403 - CVSS评分: 9.8 - 研究人员: Osvaldo Noe Gonzalez Del Rio (Os) - 发布日期: January 16, 2026 总结 RegistrationMagic 插件存在多个安全漏洞，包括跨站请求伪造、权限提升、认证绕过等。建议用户尽快升级到最新版本 6.0.9.2 或更高版本以修复这些漏洞。

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

RegistrationMagic CSRF提权漏洞CVE-2026-12158分析与修复

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

RegistrationMagic CSRF提权漏洞CVE-2026-12158分析与修复

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！