CVE-2026-4299: CWE-862 Missing Authorization in mainwp MainWP Child Reports
The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.
AI Analysis
Technical Summary
CVE-2026-4299 is a missing authorization vulnerability in the MainWP Child Reports WordPress plugin (up to version 2.2.6). The issue arises from the absence of a capability check in the heartbeat_received() function within the Live_Update class. This flaw allows authenticated users with Subscriber-level privileges or higher to retrieve sensitive activity log data via the WordPress Heartbeat API by sending a specially crafted heartbeat request containing the 'wp-mainwp-stream-heartbeat' data key. The vulnerability is classified under CWE-862 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No patch or official remediation has been published by the vendor as of the provided data.
Potential Impact
An attacker with at least Subscriber-level access to a WordPress site using the vulnerable MainWP Child Reports plugin can access sensitive activity log information, including action summaries, user details, IP addresses, and contextual data. This exposure could aid in reconnaissance or further attacks but does not allow modification or denial of service. The confidentiality of certain internal logs is compromised, but integrity and availability are not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unusual heartbeat API requests. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the MainWP vendor for any forthcoming patches or official mitigations.
CVE-2026-4299: CWE-862 Missing Authorization in mainwp MainWP Child Reports
Description
The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-4299 is a missing authorization vulnerability in the MainWP Child Reports WordPress plugin (up to version 2.2.6). The issue arises from the absence of a capability check in the heartbeat_received() function within the Live_Update class. This flaw allows authenticated users with Subscriber-level privileges or higher to retrieve sensitive activity log data via the WordPress Heartbeat API by sending a specially crafted heartbeat request containing the 'wp-mainwp-stream-heartbeat' data key. The vulnerability is classified under CWE-862 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No patch or official remediation has been published by the vendor as of the provided data.
Potential Impact
An attacker with at least Subscriber-level access to a WordPress site using the vulnerable MainWP Child Reports plugin can access sensitive activity log information, including action summaries, user details, IP addresses, and contextual data. This exposure could aid in reconnaissance or further attacks but does not allow modification or denial of service. The confidentiality of certain internal logs is compromised, but integrity and availability are not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unusual heartbeat API requests. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the MainWP vendor for any forthcoming patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-03-16T19:23:21.908Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d5da2a43e2781badfbe611
Added to database: 4/8/2026, 4:31:38 AM
Last enriched: 4/15/2026, 11:58:34 AM
Last updated: 5/23/2026, 9:59:46 PM
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.