The MainWP Child Reports plugin fails to verify user capabilities when handling heartbeat requests, allowing any authenticated user with Subscriber-level access or higher to fetch activity log entries over the WordPress Heartbeat API. These logs expose action summaries, user identities, IP addresses, and contextual information that could aid further attacks or compromise site integrity.

All WordPress sites running MainWP Child Reports up to and including version 2.2.6 are impacted. The vulnerability originates in the Live_Update class’s heartbeat_received() function within the plugin.

The CVSS score of 5.3 indicates moderate severity: exploitation requires valid credentials but no privileged access. Although the exploit is not included in public known exploit catalogs, the ability to read sensitive logs represents a significant risk for reconnaissance and credential compromise. Administrators should prioritize remediation and monitor for anomalous log access.