CVE-2026-12158: Metagauss RegistrationMagic CSRF privilege escalation

CVE-2026-12158 · Severity: high · CVSS 8.8 · Published 2026-07-01

RegistrationMagic is a WordPress plugin used to create custom user registration forms and manage submissions. A security flaw allows an attacker to trick a site administrator into unknowingly performing an action, such as clicking a link, which can result in the attacker gaining full administrative control over the website. This could lead to complete site takeover, data theft, or the insertion of malicious content.

Technologies: Metagauss RegistrationMagic. Vendors: Metagauss.

Quick answers

Is CVE-2026-12158 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12158 being exploited in the wild.
How severe is CVE-2026-12158?
High severity, with a CVSS score of 8.8, published 1 July 2026.
Which products and versions are affected?
Metagauss RegistrationMagic up to, and including, 6.0.9.1.
Is there a fix for CVE-2026-12158?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12158 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-12158?
Check whether you run Metagauss RegistrationMagic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The RegistrationMagic plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'process_request' function. By leveraging this vulnerability, an unauthenticated attacker can forge a request to create a malicious Chronos automation task. If a site administrator is tricked into executing the forged request (e.g., by clicking a link), the malicious task is subsequently executed via WordPress cron. This allows the attacker to escalate the privileges of an arbitrary form submitter to the administrator level, leading to full site compromise.

Affected products

  • Metagauss RegistrationMagic – User Registration Forms Plugin up to, and including, 6.0.9.1

Timeline

  • 2026-07-01: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.