CVE-2026-12255: Unknown Mainwp Child

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.

Affected products

• Unknown Mainwp Child: before 6.1.2 (fixed in 6.1.2)

Published 2026-07-27. Last modified 2026-07-27.