high8.1
CVE-2026-12255
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication h…
Impact
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Affected products
| Product | Affected versions |
|---|---|
| MainWP Child WordPress Plugin | before 6.1.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.