CVE-2026-12158 is a high-severity CSRF vulnerability in the RegistrationMagic WordPress plugin versions up to 6.0.9.1. The issue stems from missing or incorrect nonce validation on the process_request function, allowing attackers to create malicious Chronos automation tasks executed via WordPress cron. By leveraging this, attackers can escalate privileges of an arbitrary form submitter to administrator if they can trick a site administrator into performing an action such as clicking a crafted link. This vulnerability requires low attack complexity and no user interaction beyond the administrator being tricked, resulting in high impact on confidentiality, integrity, and availability.

Successful exploitation allows privilege escalation to administrator level from an arbitrary form submitter account. This compromises site confidentiality, integrity, and availability by enabling attackers to gain full administrative control. The attack requires tricking a site administrator to perform an action, but no prior authentication is needed for the attacker. This can lead to complete site takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger the vulnerable process_request function. Monitoring for suspicious cron tasks and restricting administrative actions to trusted users may reduce risk. Follow updates from the vendor metagauss for an official patch or mitigation instructions.