CVE-2026-12255 MainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site Registration
Unauthenticated attackers can bypass authentication and gain administrator access if passwordless login is enabled in the MainWP Child plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12255?
CVE-2026-12255 is a high-severity authentication bypass vulnerability in Unknown MainWP Child, published on 27 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
Weakness: CWE-287
Which versions are affected by CVE-2026-12255?
How do I fix CVE-2026-12255?
No fix has been published for CVE-2026-12255 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-12255 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12255 exists.
Sources
Also known as GHSA-4ph4-5rpm-wrw9.