MainWP Child: Deserialization of untrusted data (PHP object injection)
Summary
The MainWP Child WordPress plugin, up to and including version 6.2.1, contains a deserialization vulnerability (CWE-502) that allows PHP object injection. According to the CVSS vector, an unauthenticated remote attacker can send crafted data, but a privileged user must perform an action such as clicking a link or submitting a form. Successful exploitation could allow attackers to run commands or gain extra access on the affected WordPress site, and because the plugin connects sites to the MainWP Dashboard, a compromised site could expose other managed sites.
Affected
- MainWP Child plugin for WordPress, versions up to and including 6.2.1
- CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) per the CVE record; VulDB lists 6.3 (Medium)
Fixed in
- Update to MainWP Child 6.2.2 or later (per the CVE solution, Patchstack and WPScan; the official MainWP advisory was not confirmed)
Workaround
Unknown.
Exploitation
- Not known to be exploited (KEV: No)
- VulDB: no public technical details or exploit available
- Patchstack rates it high priority and expects exploitation
- EPSS: 0.25%
Our recommendation
- Inventory all WordPress sites running MainWP Child and record their versions
- Update all affected sites to MainWP Child 6.2.2 or later as soon as possible
- Remove or deactivate MainWP Child on sites that are no longer managed
- Review the Dashboard connection settings and the Unique Security ID configuration
- Check the Patchstack and MainWP advisories for changes to the fixed version or CVSS score
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory for MainWP Child 6.2.1 patchstack.com
- VulDB entry 415485 vuldb.com
- Secondary feed (HOL Guard) for CVE-2026-105436 hol.org
- Strix CVE record for CVE-2026-105436 www.strix.ai
- CVE record mirror (threatint) cve.threatint.com
- EPSS and metadata (Vulners, Rapid7) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:12.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.