{"id":"CVE-2026-12255","aliases":["EUVD-2026-49065","GHSA-4ph4-5rpm-wrw9"],"status":"published","title":"MainWP Child \u003c 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration","description":"The MainWP Child  WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00468,"percentile":0.41005,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-07-27T06:00:01Z","modified":"2026-07-27T20:33:01Z","products":[{"vendor":"mainwp","product":"mainwp child"},{"vendor":"unknown","product":"mainwp child"}],"references":[{"url":"https://wpscan.com/vulnerability/6ecd37bf-f48a-4f7f-8a93-e7f0475371af/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12255"},{"url":"https://wpscan.com/vulnerability/6ecd37bf-f48a-4f7f-8a93-e7f0475371af"},{"url":"https://github.com/advisories/GHSA-4ph4-5rpm-wrw9"}],"sources":{"cve":[{"id":"CVE-2026-12255","title":"MainWP Child \u003c 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration","description":"The MainWP Child  WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.","status":"published","published":"2026-07-27T06:00:01.619Z","modified":"2026-07-27T15:50:54.586Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:19:48.461833Z"}],"euvd":[{"id":"EUVD-2026-49065","description":"The MainWP Child  WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.","status":"published","published":"2026-07-27T06:00:01Z","modified":"2026-07-27T15:50:54Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:34.216106Z"}],"ghsa":[{"id":"GHSA-4ph4-5rpm-wrw9","title":"The MainWP Child  WordPress plugin before 6.1.2 does not verify the requester's identity in its...","description":"The MainWP Child  WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.","status":"published","published":"2026-07-27T09:31:24Z","modified":"2026-07-27T18:31:46Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:09:51.407039Z"}],"nvd":[{"id":"CVE-2026-12255","description":"The MainWP Child  WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.","status":"published","published":"2026-07-27T07:16:24.283Z","modified":"2026-07-27T20:33:01.673Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:32.830533Z"}]}}