CVE-2026-24374: 
WordPress vulnerability analysis and mitigation

CVE-2026-24374 is a Cross-Site Request Forgery (CSRF) vulnerability in the Metagauss RegistrationMagic WordPress plugin (custom-registration-form-builder-with-submission-manager). It affects all versions up to and including 6.0.6.9, and was discovered by researcher 0xd4rk5id3, reported on December 11, 2025, and published by Patchstack on January 10, 2026. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), arising from insufficient or absent CSRF token validation in the RegistrationMagic plugin's request handling logic. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (such as an administrator), causes the victim's browser to submit unauthorized state-changing requests to the WordPress site on the attacker's behalf. Exploitation requires user interaction — specifically, a privileged user must be tricked into visiting a crafted page or clicking a malicious link (Patchstack).

Successful exploitation allows an attacker to force higher-privileged WordPress users to execute unwanted actions under their current authentication context, resulting in low integrity and low availability impact with no direct confidentiality exposure per the updated CVSS vector. Practical consequences may include unauthorized modification of form configurations, manipulation of registration form submissions, or disruption of plugin functionality. The impact is bounded to the scope of the authenticated victim's privileges within the WordPress installation (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the RegistrationMagic plugin at version 6.0.6.9 or earlier using tools like WPScan or Shodan, or by checking the plugin version in publicly accessible readme files.
2. Identify target action: Determine a sensitive state-changing action within the RegistrationMagic plugin (e.g., modifying form settings, deleting submissions) that lacks CSRF token validation.
3. Craft malicious request: Create an HTML page or form that automatically submits a forged HTTP request to the target WordPress site's vulnerable RegistrationMagic endpoint, mimicking a legitimate admin action.
4. Deliver payload: Trick an authenticated WordPress administrator or privileged user into visiting the malicious page via phishing email, social engineering, or embedding the payload on a compromised third-party site.
5. Achieve objective: The victim's browser sends the forged request with their valid session cookies, causing the WordPress site to execute the unauthorized action (e.g., altering form configurations or deleting data) on the attacker's behalf (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to RegistrationMagic plugin endpoints (e.g., paths containing custom-registration-form-builder-with-submission-manager) originating from unusual referrer URLs or external domains.
• Application: Unexplained changes to RegistrationMagic form configurations, settings, or submission data without corresponding administrator activity.
• Network: HTTP requests to WordPress admin-ajax.php or plugin-specific endpoints with RegistrationMagic action parameters arriving from external or unfamiliar referrer origins.

The vulnerability is patched in RegistrationMagic version 6.0.7.0. Site administrators should update the plugin to version 6.0.7.0 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin area using IP allowlisting. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and responsibly disclosed by independent researcher 0xd4rk5id3 through Patchstack's coordinated disclosure process. Patchstack classified the issue as low priority with unlikely exploitation impact. No significant broader media coverage or notable community discussion beyond standard vulnerability database aggregation has been observed for this CVE.