CVE-2026-4299 mainwp CVE debrief

Who should care

Administrators of WordPress installations using the MainWP Child Reports plugin should review and update their installations to mitigate potential unauthorized access to activity logs. Security teams and vulnerability management teams should also be aware of this vulnerability and its potential impact on their systems.

Technical summary

The vulnerability is due to a missing capability check in the heartbeat_received() function in the Live_Update class of the MainWP Child Reports plugin. This allows attackers to send crafted heartbeat requests with the 'wp-mainwp-stream-heartbeat' data key to access activity log entries. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This vulnerability allows authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries via the WordPress Heartbeat API.

Defensive priority

Medium priority due to the potential for unauthorized access to sensitive information. Defenders should verify affected scope and severity, and review and update their installations to mitigate potential unauthorized access to activity logs.

Recommended defensive actions

• Update the MainWP Child Reports plugin to the latest version.
• Review WordPress Heartbeat API usage and restrict access to sensitive data.
• Monitor activity logs for suspicious access patterns.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-04-08T05:16:06.520Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Deferred. The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This vulnerability allows authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries via the WordPress Heartbeat API. Evidence of exploitation is limited, and defenders should verify affected scope and severity. The vendor has not provided a patch, and users should review and update their installations to mitigate potential unauthorized access to activity logs.

Official resources