EUVD-2026-49065
GHSA-4ph4-5rpm-wrw9
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires password auth disabled, so AC:H; no privileges or user interaction; total impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
AnalysisAI
MainWP Child plugin before 6.1.2 on WordPress allows unauthenticated attackers to hijack any account, including administrators, by sending a crafted site-registration request when password authentication is disabled for the targeted account. A publicly available exploit exists, but no active exploitation has been confirmed by CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | This vulnerability is only exploitable if the targeted account (e.g., an administrator) has password authentication explicitly disabled in the MainWP Child configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-accessible vulnerability with high attack complexity, no privileges, no user interaction, and total compromise of confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running a vulnerable MainWP Child plugin where the admin account has password authentication disabled. By sending a single unauthorized registration request containing that admin username, the attacker receives a valid session cookie and gains full administrative control over the site. |
| Remediation | Upgrade MainWP Child to version 6.1.2 or later, as the vendor has released a fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mainwp Child
View allThe MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a
The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc
Broken access control in the MainWP Child WordPress plugin (versions 6.1.1 and earlier) allows remote attackers to invok
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including,
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today