CVE-2026-1054: 
WordPress vulnerability analysis and mitigation

CVE-2026-1054 is a Missing Authorization vulnerability in the RegistrationMagic plugin for WordPress, affecting versions up to and including 6.0.7.4. The flaw allows unauthenticated attackers to modify arbitrary plugin settings — including reCAPTCHA keys, security settings, and frontend menu titles — by exploiting the unprotected rm_set_otp AJAX action handler. It was published on January 28, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). Specifically, the rm_set_otp AJAX action handler in the plugin's options controller (class_rm_options_controller.php) lacks both nonce verification and WordPress capability checks, meaning any unauthenticated HTTP request can invoke it. An attacker can send a crafted AJAX POST request to the WordPress admin-ajax.php endpoint targeting this action without any authentication token or privilege. The vulnerable code path is visible in the plugin's source at version 6.0.6.9 and was patched in changeset 3444777 (Wordfence, WordPress Trac).

Successful exploitation allows unauthenticated attackers to tamper with plugin configuration settings, including disabling or replacing reCAPTCHA keys (potentially enabling spam or bot-driven form submissions), altering security settings, and modifying frontend menu titles visible to site visitors. The integrity impact is low and scoped to the plugin's settings; there is no direct confidentiality or availability impact. However, weakening security controls (e.g., disabling CAPTCHA) could facilitate secondary attacks such as credential stuffing or spam registration campaigns against the affected WordPress site (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1054 as of the available data. The EPSS score is approximately 0.045%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence).

1. Reconnaissance: Identify WordPress sites running the RegistrationMagic plugin at version 6.0.7.4 or earlier using tools like WPScan, Shodan, or by checking the plugin's readme.txt file exposed at wp-content/plugins/custom-registration-form-builder-with-submission-manager/readme.txt.
2. Craft AJAX request: Prepare an HTTP POST request targeting the WordPress AJAX endpoint: POST /wp-admin/admin-ajax.php with the body parameter action=rm_set_otp and the desired settings payload (e.g., modified reCAPTCHA site key or security option values).
3. Send unauthenticated request: Submit the crafted request without any authentication cookies or nonce tokens. Because the handler performs no capability or nonce checks, the server processes the request as valid.
4. Confirm settings modification: Verify the change by visiting the affected plugin's frontend or admin panel, confirming that the targeted setting (e.g., reCAPTCHA key, security toggle) has been altered as intended (Wordfence, WordPress Trac).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php with action=rm_set_otp originating from unauthenticated (non-logged-in) sources or unfamiliar IP addresses.
• Logs: WordPress access logs showing repeated or anomalous calls to admin-ajax.php?action=rm_set_otp without associated authenticated session cookies.
• Application: Unexpected changes to RegistrationMagic plugin settings in the WordPress admin panel, particularly reCAPTCHA keys, OTP/security configurations, or frontend menu titles, without corresponding admin activity in the audit log.

Site administrators should update the RegistrationMagic plugin to a version above 6.0.7.4, as the vulnerability was patched in changeset 3444777 on the WordPress plugin repository. If an immediate update is not possible, consider disabling the plugin temporarily or restricting access to admin-ajax.php for unauthenticated users via web server rules (e.g., blocking requests with action=rm_set_otp at the WAF or server level). Regularly audit plugin settings for unauthorized changes as an interim detective control (Wordfence, WordPress Trac).

Wordfence included CVE-2026-1054 in its weekly WordPress vulnerability report for the period of January 26 – February 1, 2026, as part of routine disclosure coverage. No notable independent researcher commentary, significant social media discussion, or major media coverage has been identified for this vulnerability (Wordfence Blog).