CVE-2026-12255 in Child Plugin
Summary
by MITRE • 07/27/2026
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability in MainWP Child WordPress plugin versions prior to 6.1.2 represents a critical authentication bypass flaw that undermines the security posture of managed WordPress environments. This issue occurs within the site-registration request handler where the plugin fails to properly validate requester identity when password authentication has been disabled for targeted accounts. The flaw specifically manifests when an attacker can manipulate the registration process to obtain valid authentication sessions without proper credentials, effectively allowing unauthorized access to administrator accounts through a single malicious registration request.
The technical implementation of this vulnerability stems from inadequate input validation and authentication checks within the plugin's registration endpoint. When password authentication is disabled for an account, the system should enforce strict verification mechanisms to prevent unauthorized session creation. However, the plugin's code fails to properly authenticate the registration request origin, allowing attackers to craft registration requests that appear legitimate while actually creating valid sessions for targeted accounts. This represents a classic case of insufficient validation and authentication controls, aligning with CWE-287 which addresses improper authentication issues in software systems.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it enables attackers to gain administrative control over WordPress sites managed through the MainWP platform. Since MainWP is designed for managing multiple WordPress installations from a central dashboard, successful exploitation allows attackers to compromise entire networks of interconnected sites. The vulnerability particularly affects environments where password authentication has been disabled for security reasons, creating a false sense of protection while simultaneously exposing systems to attack vectors that bypass these very security measures.
Organizations using MainWP Child plugin versions before 6.1.2 face significant risk exposure as this vulnerability can be exploited without requiring prior access credentials or system compromise. The single request mechanism makes exploitation straightforward and potentially automated, allowing attackers to quickly establish persistent administrative sessions. This aligns with ATT&CK technique T1078 which covers valid accounts usage, where adversaries leverage legitimate credentials to maintain access to systems. The vulnerability essentially transforms any unauthenticated attacker into a potential administrator with full privileges over the compromised WordPress installations.
The recommended mitigation strategy involves immediate upgrade to MainWP Child plugin version 6.1.2 or later, which contains the necessary authentication verification fixes. Organizations should also implement additional monitoring of registration endpoints and authentication-related system logs to detect potential exploitation attempts. Security teams should review account configurations to ensure that disabling password authentication is properly secured and that proper access controls are maintained. Network segmentation and web application firewalls can provide additional layers of protection against such attacks while the primary fix is implemented, though these measures do not address the core vulnerability in the plugin's authentication handling mechanisms.