The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capability check in the heartbeat_received() function in the Live_Update class. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain MainWP Child Reports activity log entries (including action summaries, user information, IP addresses, and contextual data) via the WordPress Heartbeat API by sending a crafted heartbeat request with the 'wp-mainwp-stream-heartbeat' data key.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Mainwp Child Reports Plugin | — | Update mainwp-child-reports plugin to version 2.3, or a newer patched version | May 5, 2026 | Apr 7, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub