CVE-2026-12158 is a high-severity CSRF vulnerability affecting the RegistrationMagic WordPress plugin up to version 6.0.9.1. The issue is caused by missing or incorrect nonce validation in the process_request function, allowing attackers to forge requests that execute malicious Chronos automation tasks via WordPress cron. This can escalate privileges of an arbitrary form submitter to administrator if a site administrator is tricked into triggering the forged request. The vulnerability requires no user interaction from the attacker but does require the site administrator to perform an action such as clicking a crafted link.

Successful exploitation allows an unauthenticated attacker to escalate privileges of an arbitrary form submitter to administrator level, potentially compromising the entire WordPress site. This includes full control over site content, user management, and configuration, leading to complete confidentiality, integrity, and availability loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, administrators should avoid interacting with suspicious links or actions that could trigger the vulnerability. Monitor official metagauss channels for updates and apply any released patches promptly.