CVE-2026-27366
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The MainWP Child plugin versions up to 6.1.1 contain a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized operations on the site without requiring authentication.
Risk Assessment
The organization is at risk of having its WordPress site taken over by an unauthenticated attacker, potentially leading to data theft, defacement, or further malware distribution.
Recommendation
Immediately update the MainWP Child plugin to version 6.1.2 or later. If an update is not possible, temporarily disable the plugin until a patch is applied.
Other vulnerabilities in MainWP Child
See all- CVE-2026-105436High
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection. This issue affects MainWP Child: from n/a through 6.2.1.
- CVE-2026-12255High
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Original NVD description (English source)
Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS