CVE-2026-12255
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Risk Assessment
An attacker can log in as any user with password authentication disabled, including an administrator, leading to full site compromise.
Recommendation
Update the MainWP Child plugin to version 6.1.2 or later.
Other vulnerabilities in MainWP Child
Original NVD description (English source)
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.