MainWP Child CVE-2026-12255

This vulnerability is only exploitable if the targeted account (e.g., an administrator) has password authentication explicitly disabled in the MainWP Child configuration. In default configurations, password authentication is enabled, making the attack infeasible. Additionally, the attacker must know or guess a valid username for the targeted account.

The CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-accessible vulnerability with high attack complexity, no privileges, no user interaction, and total compromise of confidentiality, integrity, and availability. No EPSS score is available, but the public exploit code and the ability to gain administrator access increase real-world risk. SSVC: exploitation is public (POC) but not confirmed active; the attack is automatable via a single HTTP request; technical impact is total. The high complexity stems from the prerequisite that password authentication must be disabled-a non-default configuration that limits exposure. For sites matching this condition, this is a critical priority; otherwise, it is a low-risk issue.

An attacker identifies a WordPress site running a vulnerable MainWP Child plugin where the admin account has password authentication disabled. By sending a single unauthorized registration request containing that admin username, the attacker receives a valid session cookie and gains full administrative control over the site.