CVE-2026-4299

The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.

• CWE-862

• https://plugins.trac.wordpress.org/browser/mainwp-child-reports/tags/2.2.6/classes/class-live-update.php#L182
• https://plugins.trac.wordpress.org/browser/mainwp-child-reports/tags/2.2.6/classes/class-live-update.php#L44
• https://plugins.trac.wordpress.org/browser/mainwp-child-reports/trunk/classes/class-live-update.php#L182
• https://plugins.trac.wordpress.org/browser/mainwp-child-reports/trunk/classes/class-live-update.php#L44
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3490157%40mainwp-child-reports&new=3490157%40mainwp-child-reports&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7d4141bd-cd3f-44e9-b423-be03377a342d?source=cve

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42983Use after free in Windows DWM Core Library allows an authori…7.8
• CVE-2026-42984Use after free in Windows Kernel allows an authorized attack…7
• CVE-2026-42985Use after free in Remote Desktop Client allows an unauthoriz…8.8
• CVE-2026-42986Use after free in Microsoft Graphics Component allows an aut…7.8
• CVE-2026-42987Use after free in Windows Deployment Services allows an unau…8.1
• CVE-2026-42989Improper link resolution before file access ('link following…7.8
• CVE-2026-42990Heap-based buffer overflow in SQL Server ODBC driver allows …9.8
• CVE-2026-42991Concurrent execution using shared resource with improper syn…7.8
• CVE-2026-42992Heap-based buffer overflow in Remote Desktop Client allows a…7.5
• CVE-2026-42993Heap-based buffer overflow in Remote Desktop Client allows a…7.5
• CVE-2026-42994Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T…9.8
• CVE-2026-42996JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a…10