CVE-2026-105436
HighCVSS 8.8Summary
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection. This issue affects MainWP Child: from n/a through 6.2.1.
Risk Assessment
The risk includes potential arbitrary code execution by an attacker, potentially leading to full system compromise.
Recommendation
It is recommended to upgrade MainWP Child to a version newer than 6.2.1 if a fix is available.
Other vulnerabilities in MainWP Child
See all- CVE-2026-12255High
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
- CVE-2026-27366High
The MainWP Child plugin versions up to 6.1.1 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized operations on the site without requiring authentication.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS