CVE-2026-12158

The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.9/plus/chronos/controllers/task_controller.php#L63
• https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.9/plus/chronos/libs/rm_chronos.php#L277
• https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.9/plus/chronos/libs/task.php#L176
• https://plugins.trac.wordpress.org/browser/custom-registration-form-builder-with-submission-manager/tags/6.0.8.9/plus/chronos/services/service.php#L43
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3579552%40custom-registration-form-builder-with-submission-manager&new=3579552%40custom-registration-form-builder-with-submission-manager&sfp_email=&sfph_mail=#file8
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ef7aff85-e1ca-47ce-86e9-a0fe356993a1?source=cve

Published

Jul 1, 2026

Last Modified

Jul 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-121574Missing Authorization vulnerability in WP Chill Passster con…5.3
• CVE-2026-121575Missing Authorization vulnerability in WP User Manager WP Us…5.3
• CVE-2026-121576Incorrect Privilege Assignment vulnerability in AtlasAiDev M…8.8
• CVE-2026-121577Inefficient Regular Expression Complexity (CWE-1333) in gene…6.7
• CVE-2026-121578Tactical RMM contains a stored XSS vulnerability caused by i…6.1
• CVE-2026-121579Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-121580Server-side request forgery in the Jira ticketing filter loo…8.1
• CVE-2026-121581A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34…4.3
• CVE-2026-121582A vulnerability has been found in Umami up to 3.4.1. Impacte…6.5
• CVE-2026-121583A vulnerability was identified in Sanluan PublicCMS 5. This …6.3
• CVE-2026-121585A security flaw has been discovered in InfiniFlow RAGFlow up…4.3
• CVE-2026-121587Coolify before 4.1.1 contains an information disclosure vuln…5.3