VulnSocial

CVE-2026-12255Disclosure

LOWCVSS 8.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-27: 2Patch / Workaround · 2026-07-27: 1Technical Details · 2026-07-27: 207-27
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Full discourse2 posts
  • ADK Cyber@ADKCyber
    Patch

    MainWP Child WordPress plugin before 6.1.2 vulnerable to identity bypass in site registration (CVE-2026-12255, CVSS 8.1). Update if password auth is disabled. https://nvd.nist.gov/vuln/detail/… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/lL90PLYFNa

    Post summary

    The tweet announces that MainWP Child WordPress plugin versions before 6.1.2 are vulnerable to an identity bypass (CVE-2026-12255, CVSS 8.1) and recommends updating the plugin as a mitigation.

    0000036
    90 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-12255 Unauthenticated Authentication Session Bypass in MainWP Child Plugin Before 6.1.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-12255

    Post summary

    CVE‑2026‑12255 is disclosed as an unauthenticated authentication session bypass affecting MainWP Child Plugin before version 6.1.2, with no proof‑of‑concept, exploit code, or remediation details provided.

    00000132
    4.1K followersView on X

Explore more

Back to dashboard