CVE-2026-4299 is a missing authorization vulnerability in the MainWP Child Reports plugin for WordPress, affecting all versions up to and including 2.2.6. The issue arises from the absence of a capability check in the heartbeat_received() function within the Live_Update class. Exploitation requires authenticated access at Subscriber level or above and leverages the WordPress Heartbeat API with a crafted request containing the 'wp-mainwp-stream-heartbeat' data key to retrieve sensitive activity log data. This vulnerability does not impact integrity or availability but allows unauthorized disclosure of potentially sensitive information.

An attacker with at least Subscriber-level authenticated access can obtain sensitive activity log entries from the MainWP Child Reports plugin, including user actions, IP addresses, and contextual information. This unauthorized information disclosure could aid in further reconnaissance or targeted attacks but does not allow modification or disruption of the system.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Users should monitor the MainWP vendor advisories for updates and consider restricting Subscriber-level access or disabling the plugin until a fix is released. No temporary or official fixes are documented at this time.