Summary
CVE-2026-12255 is a high-severity authentication bypass vulnerability (CWE-287: Improper Authentication) in the MainWP Child WordPress plugin, affecting all versions before 6.1.2. The flaw allows an unauthenticated remote attacker to obtain a fully valid authenticated session — including administrator-level access — by exploiting a missing identity verification step in the plugin’s site-registration request handler. With over 700,000 active installations, the potential exposure across internet-facing WordPress sites is significant.
Technical details
- Root cause: The plugin’s site-registration request handler does not verify the requester’s identity when password authentication has been disabled for the targeted account (CWE-287: Improper Authentication). This passwordless configuration — in which the plugin is designed to authenticate via other means — removes the credential check entirely from the registration flow, leaving it open to abuse.
- Trigger condition: Exploitation requires that password authentication is disabled for at least one user account on the target WordPress site. The attacker must know or successfully guess a valid account login name.
- Attack vector: An unauthenticated remote attacker sends a single site-registration request to the plugin’s handler, supplying only the login name of the targeted account. Because no password or credential verification is performed under the passwordless configuration, the server issues a valid authenticated session for that account.
- Impact: Successful exploitation grants the attacker a fully authenticated WordPress session as the targeted user. When the targeted account holds administrator privileges, this leads to complete site takeover — including arbitrary content modification, theme and plugin management, user account manipulation, and potential remote code execution via malicious plugin or theme upload.
Affected software
- MainWP Child WordPress Plugin — all versions before 6.1.2
Severity
- CVSS v3.1 Base Score: 8.1 (HIGH)
- Vector String:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate action: Update the MainWP Child plugin to version 6.1.2 or later. Version 6.1.2 (released June 16, 2026) hardens the site-registration and connection verification flow: when password authentication is disabled, adding or reconnecting a site now requires the site’s Unique Security ID, closing the unauthenticated bypass path.
- If immediate patching is not feasible: Re-enable password authentication for all accounts on affected WordPress sites to eliminate the trigger condition for this vulnerability. Additionally, restrict network-level access to the WordPress administrative interface and plugin endpoints where possible to reduce the attack surface.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.