CVE-2026-1054: WordPress RegistrationMagic Auth Bypass

CVE-2026-1054 Overview

The RegistrationMagic plugin for WordPress contains a Missing Authorization vulnerability in versions up to and including 6.0.7.4. The vulnerability stems from missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This security flaw allows unauthenticated attackers to modify arbitrary plugin settings remotely, including reCAPTCHA keys, security settings, and frontend menu titles.

Critical Impact

Unauthenticated attackers can modify critical security settings including reCAPTCHA configurations, potentially disabling bot protection and enabling automated attacks against WordPress sites using the RegistrationMagic plugin.

Affected Products

• RegistrationMagic WordPress Plugin versions up to and including 6.0.7.4
• WordPress installations using vulnerable RegistrationMagic versions
• Custom Registration Form Builder with Submission Manager (alternative plugin name)

Discovery Timeline

• 2026-01-28 - CVE CVE-2026-1054 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1054

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a critical access control flaw where the application fails to verify that a user has the appropriate permissions before allowing access to protected functionality. In the context of the RegistrationMagic plugin, the rm_set_otp AJAX action handler processes requests without validating whether the requester has administrative privileges or verifying the request's authenticity through WordPress nonces.

The absence of these security controls means that any visitor to a WordPress site running the vulnerable plugin can invoke this AJAX endpoint and manipulate plugin settings. The attack surface includes modification of reCAPTCHA keys (which could disable CAPTCHA protection entirely), security settings (potentially weakening the site's defenses), and frontend menu titles (enabling potential phishing or social engineering attacks).

Root Cause

The root cause of this vulnerability lies in the class_rm_options_controller.php file, specifically in the implementation of the AJAX action handler. The code fails to implement two critical WordPress security mechanisms:

1. Missing Nonce Verification: WordPress nonces are security tokens that help protect against CSRF attacks by validating that requests originate from legitimate sources. The vulnerable code does not call wp_verify_nonce() or check_ajax_referer() to validate incoming requests.

2. Missing Capability Checks: WordPress provides a robust capabilities system for access control. The vulnerable code does not call current_user_can() to verify that the user has appropriate administrative privileges before processing the settings modification request.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by crafting a malicious HTTP request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to rm_set_otp. The attacker can include arbitrary plugin settings in the request payload, which will be processed and saved without any authorization checks.

A typical attack scenario would involve:

1. Identifying a WordPress site running the vulnerable RegistrationMagic plugin
2. Sending a crafted POST request to the site's admin-ajax.php endpoint
3. Including the action=rm_set_otp parameter along with malicious setting values
4. The vulnerable plugin processes the request and modifies settings accordingly

The attacker could disable reCAPTCHA protections to enable automated bot registrations, modify security settings to weaken the site's defenses, or change frontend menu titles for phishing purposes. For technical implementation details, refer to the WordPress Plugin Code Snippet.

Detection Methods for CVE-2026-1054

Indicators of Compromise

• Unexpected modifications to RegistrationMagic plugin settings, particularly reCAPTCHA configurations
• Suspicious POST requests to /wp-admin/admin-ajax.php with action=rm_set_otp from unauthenticated sessions
• Changes to frontend menu titles or security settings without corresponding administrative activity in user logs
• Increased bot activity or spam registrations following unexplained reCAPTCHA key changes

Detection Strategies

• Monitor WordPress AJAX endpoints for unauthenticated requests targeting the rm_set_otp action
• Implement Web Application Firewall (WAF) rules to detect and block malicious requests to admin-ajax.php with suspicious parameters
• Review Apache/Nginx access logs for POST requests to admin-ajax.php from IP addresses not associated with known administrators
• Deploy file integrity monitoring to detect unauthorized changes to plugin configuration files

Monitoring Recommendations

• Enable WordPress debug logging to capture AJAX request details for forensic analysis
• Configure alerts for any changes to RegistrationMagic plugin settings outside of scheduled maintenance windows
• Implement real-time monitoring of wp_options table modifications related to the RegistrationMagic plugin
• Set up automated daily comparisons of critical plugin settings against known-good baselines

How to Mitigate CVE-2026-1054

Immediate Actions Required

• Update the RegistrationMagic plugin to a version newer than 6.0.7.4 immediately
• Audit current plugin settings to identify any unauthorized modifications, particularly reCAPTCHA keys and security configurations
• Review WordPress access logs for evidence of exploitation attempts targeting the rm_set_otp action
• Consider temporarily deactivating the plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in a subsequent release of the RegistrationMagic plugin. The fix implements proper nonce verification and capability checks on the rm_set_otp AJAX action handler. Site administrators should update to the latest version available in the WordPress plugin repository. The security fix can be reviewed in WordPress Changeset #3444777. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Implement a custom WordPress plugin or functions.php modification to add authorization checks to the vulnerable AJAX handler as a temporary measure
• Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests containing action=rm_set_otp
• Restrict access to admin-ajax.php at the web server level for non-authenticated users if site functionality permits
• Monitor and restore RegistrationMagic settings from backups if tampering is detected while awaiting patch deployment

# Configuration example - WAF rule for Apache .htaccess
# Block unauthenticated access to the vulnerable AJAX action
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} admin-ajax\.php$
RewriteCond %{QUERY_STRING} action=rm_set_otp [OR]
RewriteCond %{THE_REQUEST} action=rm_set_otp
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>