Executive brief
MainWP Child Reports is a WordPress plugin used to track and log activity on child sites managed via MainWP. A security flaw allows any logged-in user, even those with minimal permissions like subscribers, to view sensitive activity logs. These logs contain user information, IP addresses, and details about actions taken on the site, which could be used to facilitate further attacks or compromise user privacy.
Technical details
The MainWP Child Reports plugin for WordPress is vulnerable to an authorization bypass due to a missing capability check in the heartbeat_received() function within the Live_Update class. This vulnerability allows authenticated attackers with Subscriber-level permissions or higher to retrieve activity log entries via the WordPress Heartbeat API. By sending a crafted heartbeat request containing the 'wp-mainwp-stream-heartbeat' data key, an attacker can access action summaries, user metadata, and IP addresses. The issue is present in all versions up to 2.2.6 and was addressed in subsequent updates.
Affected products
- MainWP MainWP Child Reports up to and including 2.2.6
Timeline
- 2026-04-08: disclosed
- 2026-04-08: advisory
References
- https://plugins.trac.wordpress.org/browser/mainwp-child-reports/tags/2.2.6/classes/class-live-update.php
- https://plugins.trac.wordpress.org/browser/mainwp-child-reports/tags/2.2.6/classes/class-live-update.php
- https://plugins.trac.wordpress.org/browser/mainwp-child-reports/trunk/classes/class-live-update.php
- https://plugins.trac.wordpress.org/browser/mainwp-child-reports/trunk/classes/class-live-update.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3490157%40mainwp-child-reports&new=3490157%40mainwp-child-reports&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4141bd-cd3f-44e9-b423-be03377a342d?source=cve