Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-08 | 1 | General1 |
| 2026-04-13 | 1 | Disclosure1 |
CVE-2026-4299 The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability chec… https://www.cve.org/CVERecord?id=CVE-2026-4299
Post summary
The text announces a missing authorization vulnerability in the MainWP Child Reports WordPress plugin and provides basic technical details, but no PoC, exploit, or mitigation information.
CVE-2026-4299 Missing Authorization in MainWP Child Reports Plugin Up to Version 2.2.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4299
Post summary
A brief vulnerability note with minimal detail and no actionable information.