Mainwp Child Reports EUVD-2026-20044

The CVSS 5.3 score reflects a low-to-moderate risk posture: the attack vector is network-accessible without requiring user interaction (UI:N), and the complexity is low, but the impact is confidentiality loss only (C:L/I:N/A:N) with no privilege escalation or system modification. However, this score masks the practical severity for MainWP deployments. MainWP is a multi-site management platform, and activity logs typically contain sensitive operational data (user actions, IP addresses, timestamps) that can aid reconnaissance for targeted attacks or insider threats. The CVSS vector shows PR:N (no privileges required to trigger the request), but the description correctly clarifies that Subscriber-level WordPress authentication is required-this is a privilege requirement in the WordPress context but not in traditional network-level CVSS terms. The combination of confirmed reproducibility (Wordfence disclosure), clear code references in the vulnerable plugin version, missing authorization check (not a design dispute or edge case), and sensitivity of the data exposed elevates practical risk. No public exploit code or active KEV status was identified, reducing immediate incident response urgency, but the ease of exploitation (crafted HTTP POST to WordPress admin-ajax.php) means threat actors can weaponize this quickly once aware. Organizations with exposed MainWP installations and users holding Subscriber roles pose higher risk.

An attacker with a Subscriber account (the lowest WordPress user role, sometimes created for comment moderation or client access) logs into a WordPress site using the MainWP Child Reports plugin. The attacker sends an AJAX POST request to /wp-admin/admin-ajax.php with action='mainwp_stream_heartbeat' and data containing 'wp-mainwp-stream-heartbeat', mimicking a legitimate browser heartbeat update. Because the heartbeat_received() function lacks authorization verification, the plugin returns recent activity log entries detailing administrator actions, user logins, IP addresses, and configuration changes. The attacker collects this reconnaissance data to identify high-value targets, unpatched systems, or privileged users for subsequent social engineering or direct attacks. No user interaction is required beyond the attacker's ability to maintain a valid login session, and the request-response cycle is completed within seconds.