What is the CVSS score of CVE-2026-27366?

CVE-2026-27366 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of MainWP Child are affected by CVE-2026-27366?

The MainWP Child WordPress plugin (versions 6.1.1 and earlier) contains a broken access control vulnerability permitting unauthenticated remote users to perform administrative operations on affected…

How to fix or mitigate CVE-2026-27366?

24 hours: Inventory all WordPress installations running MainWP Child plugin versions 6.1.1 or earlier. 7 days: Disable the plugin on non-production systems; implement Web Application Firewall (WAF) rules to block access to MainWP administrative interfaces; restrict network access via firewall to authorized personnel only; contact vendor for patch availability and expected release date. 30 days: Monitor vendor security advisories for patch release; if no patch is forthcoming, evaluate and execute migration to alternative WordPress management solutions.

MainWP Child CVE-2026-27366

EUVD-2026-39362 HIGH

Missing Authorization (CWE-862)

2026-06-25 Patchstack

GHSA-hpf4-4ccj-785m

WordPress Authentication Bypass Mainwp Mainwp Child Wordpress Plugin

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but gated by required victim interaction (UI:R) and non-trivial preconditions (AC:H); missing authorization can yield full data and integrity impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:16 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.

AnalysisAI

Broken access control in the MainWP Child WordPress plugin (versions 6.1.1 and earlier) allows remote attackers to invoke privileged actions without proper authorization checks (CWE-862). Because the flaw is reachable without authentication (PR:N) it can be triggered by external attackers, though exploitation depends on tricking a user into an action (UI:R) and on overcoming non-trivial conditions (AC:H). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

MainWP Child is the agent-side plugin of the MainWP ecosystem, installed on managed ('child') WordPress sites so a central MainWP Dashboard can administer them remotely. The root cause is CWE-862 (Missing Authorization): one or more plugin endpoints/handlers perform sensitive operations without verifying that the requester holds the required capability or that the request originates from a legitimately paired Dashboard. The single CPE in scope, cpe:2.3:a:mainwp:mainwp_child, confirms only the MainWP Child plugin itself is affected (not the MainWP Dashboard). The 'Authentication Bypass' tag combined with CWE-862 indicates the access-control gate, rather than the authentication credential check, is what fails - privileged functionality is exposed to actors who should not reach it.

RemediationAI

No vendor-released patch version was identified in the supplied data; the '<= 6.1.1' affected range implies a fixed release (likely 6.1.2 or later) exists, but it is not confirmed here, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/mainwp-child/vulnerability/wordpress-mainwp-child-plugin-6-1-1-broken-access-control-vulnerability) and the official MainWP changelog to obtain and install the next available release above 6.1.1. Until a confirmed patch is applied, compensating controls include restricting access to the WordPress site's MainWP Child endpoints (the plugin is designed to be contacted only by your MainWP Dashboard, so IP-allowlisting the Dashboard server at the web server or firewall sharply limits exposure, at the trade-off of breaking management if the Dashboard IP changes); enabling the plugin's 'unique connection security ID' / Dashboard-pairing options if not already in use; and deploying a WordPress WAF/virtual patch from Patchstack or a comparable vendor to block unauthorized requests to the vulnerable handlers. If the site is not actively managed by a MainWP Dashboard, deactivating and removing MainWP Child entirely eliminates the exposure with no functional downside.