RegistrationMagic CVE-2026-12158

Exploitation requires the RegistrationMagic plugin (≤6.0.9.1) installed with the Chronos automation subsystem reachable, and it depends on tricking an authenticated site administrator into performing an action such as clicking an attacker-controlled link while their admin session is active - that admin interaction is the primary limiting factor. The attacker also needs a controllable account/identity as a 'form submitter' to be the target of the privilege escalation, and WordPress cron must fire to execute the planted Chronos task (introducing a timing dependency). Limiting factors: the attack fails if the admin is not logged in, if the forged link is not clicked, or if the plugin is updated past 6.0.9.1; note the official CVSS marks UI:N, which contradicts the description's clear requirement for admin interaction.

The provided CVSS is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but this vector conflicts with the description in two ways worth flagging: the description says the attacker is unauthenticated (implying PR:N, not PR:L) and that exploitation requires tricking an administrator into clicking a link (implying UI:R, not UI:N) - verify with Wordfence, as CSRF is conventionally scored PR:N/UI:R. Either way the technical impact is high (full admin takeover). No EPSS score, KEV entry, or POC was supplied, so exploitation probability cannot be quantified from the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuinely high-impact issue (site takeover) but gated by social-engineering of an admin, so it is a real priority for widely-installed sites rather than a mass-automatable, worm-class flaw.

An attacker crafts a web page or email link containing a forged request to the RegistrationMagic process_request endpoint and lures a logged-in site administrator into visiting it; the browser submits the request with the admin's cookies, creating a malicious Chronos task. When WordPress cron next runs, the task elevates an attacker-controlled form submitter to administrator, giving the attacker full control of the site. No public exploit code was identified at time of analysis, but CSRF payloads of this kind are trivial to construct given the low attack complexity.