RegistrationMagic <= 6.0.9.1 CSRF to Privilege Escalation (CVE-2026-12158)

Vulnerability Overview Vulnerability Name: RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter CVE ID: CVE-2026-12158 CVSS Score: 8.8 (High) Publication Date: June 30, 2026 Last Update Date: July 1, 2026 Researcher: Chloe Chamberland - Wordfence PRISM Scope of Impact Software Type: Plugin Software Name: RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login Affected Versions: <= 6.0.9.1 Fixed Version: 6.0.9.2 Remediation Fix Method: Upgrade to version 6.0.9.2 or a later patched version. Additional Information Vulnerability Description: The RegistrationMagic - User Registration Forms Plugin contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions of WordPress (including 6.0.9.1). Due to missing or incorrect nonce verification, attackers can submit arbitrary forms as an administrator, thereby escalating privileges. Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Recent Vulnerabilities RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request - CVE ID: CVE-2026-9742 - CVSS Score: 5.3 - Researcher: Rafael Gunawan (kokon) - Publication Date: June 26, 2026 RegistrationMagic - User Registration Forms Plugin <= 6.0.8.6 - Missing Authorization - CVE ID: CVE-2026-49764 - CVSS Score: 5.3 - Researcher: James Pareman - Publication Date: June 4, 2026 RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.6 - Missing Authorization - CVE ID: CVE-2026-32498 - CVSS Score: 5.3 - Researcher: Supaklad S. (m3er) - Publication Date: March 20, 2026 RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authentication Bypass - CVE ID: CVE-2026-24373 - CVSS Score: 9.8 - Researcher: 0x04fd5d3 - Publication Date: March 12, 2026 RegistrationMagic <= 6.0.7.6 - Missing Authorization - CVE ID: CVE-2026-32385 - CVSS Score: 4.3 - Researcher: Supaklad S. (m3er) - Publication Date: February 18, 2026 RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.5.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment - CVE ID: CVE-2025-14444 - CVSS Score: 5.3 - Researcher: Md. Moniruzzaman Prodhon (NomanProdhon) - Publication Date: February 17, 2026 RegistrationMagic <= 6.0.7.2 - Missing Authorization - CVE ID: CVE-2026-0929 - CVSS Score: 4.3 - Researcher: Maktoum (bRpsd) - Publication Date: February 16, 2026 RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification - CVE ID: CVE-2026-1054 - CVSS Score: 5.3 - Researcher: Md. Moniruzzaman Prodhon (NomanProdhon) - Publication Date: January 27, 2026 RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure - CVE ID: CVE-2025-15520 - CVSS Score: 5.3 - Researcher: Maktoum (bRpsd) - Publication Date: January 23, 2026 RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order - CVE ID: CVE-2025-15403 - CVSS Score: 9.8 - Researcher: Osvaldo Noe Gonzalez Del Rio (Os) - Publication Date: January 16, 2026 Summary The RegistrationMagic plugin contains multiple security vulnerabilities, including cross-site request forgery, privilege escalation, and authentication bypasses. Users are advised to upgrade to the latest version 6.0.9.2 or higher as soon as possible to mitigate these issues.

Goal Reached Thanks to every supporter — we hit 100%!

RegistrationMagic <= 6.0.9.1 CSRF to Privilege Escalation (CVE-2026-12158)

More from this source