Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
WordPressプラグイン「RegistrationMagic」にユーザー権限昇格の脆弱性 https://www.cve.org/CVERecord?id=CVE-2026-12158 重大性スコア(CVS)：8.8 高い 本脆弱性を悪用された場合、管理者の操作をきっかけとして、サイトに登録されているユーザーの権限が意図せず引き上げられ、管理者権限を与えられる可能性があります。
Post summary
A CVE-2026-12158 vulnerability in the WordPress plugin RegistrationMagic can allow privilege escalation to administrator level; the vulnerability is rated high severity (8.8), but no PoC, exploit, or patch information is provided.
CVE-2026-12158 Cross-Site Request Forgery in RegistrationMagic User Registration Forms Plugin Up to 6.0.9.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-12158
Post summary
The post announces CVE-2026-12158, a CSRF flaw in RegistrationMagic plugin versions up to 6.0.9.1, with no further exploitation or patch information provided.