CVE-2026-12255 is an improper authentication vulnerability (CWE-287) in the MainWP Child WordPress plugin prior to version 6.1.2. The vulnerability arises because the plugin's site-registration request handler fails to verify the identity of the requester if password authentication is disabled for the targeted account. An attacker can exploit this by submitting a single registration request naming the login of the targeted account, thereby gaining a valid authentication session as that user, including administrative privileges. This vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

An unauthenticated attacker can impersonate any user account, including administrators, by exploiting the lack of authentication verification in the site-registration process. This leads to full compromise of the affected WordPress site, allowing complete control over content, settings, and potentially the underlying server environment.

No official patch or remediation level has been confirmed or published by the vendor as of the current information. Users should monitor the vendor's advisory for updates and apply the official fix once available. Until then, consider disabling the MainWP Child plugin or restricting access to the site-registration functionality to trusted users only.