MainWP Child EUVD-2026-39362

Exploitation targets the MainWP Child plugin's privileged request handlers that lack a proper capability/authorization check. Per the CVSS vector the attacker does NOT need credentials (PR:N) and acts over the network (AV:N), but two concrete limiting factors apply: user interaction is required (UI:R), meaning a victim (typically a logged-in user/admin) must perform or trigger some action, and attack complexity is high (AC:H), meaning the attacker must satisfy non-trivial conditions beyond simply sending a request. The realistic prerequisite is a reachable WordPress site with MainWP Child <= 6.1.1 active; exposure is further limited where the Dashboard connection is IP-restricted or where the site is not actively paired to a MainWP Dashboard. The exact vulnerable feature/endpoint is not detailed in the available data and should be confirmed via the Patchstack advisory.

Signals are mixed and lean toward moderate, not emergency, priority. The CVSS 3.1 base score is 7.5 (High) with full C/I/A impact, but the vector tempers this: AV:N (network) and PR:N (no auth) raise reach, while AC:H (high attack complexity) and UI:R (user interaction required) materially reduce real-world exploitability. No EPSS score was supplied, the CVE is not in CISA KEV, and no POC is referenced, so exploitation is currently theoretical/unproven. The Patchstack-sourced 7.5 rating with AC:H/UI:R suggests a vulnerability that requires specific timing or a victim action rather than a trivially automatable mass-exploit. Note a tension worth verifying with the vendor: the 'Authentication Bypass' tag and 'Unauthenticated' label imply easy access, yet the CVSS encodes AC:H and UI:R, which constrain practical exploitation - the headline 'unauthenticated' framing overstates how readily this can be weaponized at scale.

An attacker identifies a WordPress site running MainWP Child <= 6.1.1 and crafts a request to a privileged plugin handler that fails to enforce authorization, then lures a logged-in user or administrator into triggering the action (satisfying the UI:R requirement) to perform an operation the attacker could not otherwise authorize. Given AC:H, the attacker must satisfy additional conditions (such as timing, a valid request structure, or a specific site state) for the bypass to succeed. No public proof-of-concept is referenced at time of analysis.