WordPress Plugin Missing CSRF Protection Enables Admin Escalation

The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The RegistrationMagic – User Registration Forms Plugin for WordPress contains a critical Cross-Site Request Forgery (CSRF) vulnerability in its process_request function due to missing nonce validation. This flaw allows unauthenticated attackers to forge malicious requests that escalate arbitrary form submitters to administrator privileges by creating rogue Chronos automation tasks executed through WordPress cron. Any WordPress site running versions 6.0.9.1 or earlier with this plugin installed is vulnerable, making this a significant risk for organizations using this popular form plugin. The vulnerability is particularly dangerous because it requires no prior authentication and can be triggered automatically, giving attackers a direct path to administrative access.

Casky's 322 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns behind this vulnerability across TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques. Practitioners would observe detections focused on: unauthorized nonce bypass attempts in form submission handlers, detection of forged cross-origin requests targeting WordPress cron endpoints, suspicious privilege escalation from form submission contexts to administrator roles, and anomalous Chronos task creation patterns outside normal administrative workflows. The platform would surface findings showing how attackers systematically bypass CSRF protections, correlate timing patterns in cron-triggered privilege escalations, and identify the absence of proper request origin validation—enabling teams to distinguish legitimate form submissions from weaponized CSRF attacks targeting administrator account creation.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12158.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

achieving-cmmc-level-2-compliance

compliance governance · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-12158

Casky has 322 skills that investigate the attack patterns behind CVE-2026-12158. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn