{"error":0,"message":null,"data":{"name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites","plugin":"mainwp-child","link":"https:\/\/wordpress.org\/plugins\/mainwp-child\/","latest":"1788968100","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"26cf0539b4b17a06438c837c7712a694fb81ff1bc1a293f96e63b5d0bde3523e","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 4.1.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.1.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24877","name":"CVE-2021-24877","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24877","description":"[en] The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed","date":"2021-11-23"},{"id":"0be7d1b3041bbcc7f4620e643626c2b96008831f","name":"WordPress MainWP Child plugin <= 4.1.7.1 - SQL Injection (SQLi) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mainwp-child\/vulnerability\/wordpress-mainwp-child-plugin-4-1-7-1-sql-injection-sqli-vulnerability","description":"SQL Injection (SQLi) vulnerability discovered by JrXnm in WordPress MainWP Child plugin (versions <= 4.1.7.1).","date":"2021-10-25"},{"id":"42ffeaa4d6b58868d03c01778beede81ff9e4940","name":"MainWP Child <= 4.1.7.1 - SQL Injection via orderby,  order Parameters","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mainwp-child\/mainwp-child-4171-sql-injection-via-orderby-order-parameters","description":"The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed","date":"2021-10-25"},{"id":"b09fe120-ab9b-44f2-b50d-3b4b299d6d15","name":"MainWP Child &lt; 4.1.8 - Admin+ SQL Injection","link":"https:\/\/wpscan.com\/vulnerability\/b09fe120-ab9b-44f2-b50d-3b4b299d6d15","description":"The plugin does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"h","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"7.2","severity":"h","exploitable":"1.2","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"7.2","severity":"high","av":"network","ac":"low","pr":"high","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"1.2","impact":"5.9"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}]}},{"uuid":"0835a7c0b322647340a604b7b816a257e8e65436b285a3d14c236acc3b7d4c22","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.4.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"3d2e8b08ada72a6fa5d9b2d24a455546707f0736","name":"WordPress MainWP Child plugin <=3.4.4 - Authentication Bypass vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mainwp-child\/vulnerability\/wordpress-mainwp-child-plugin-3-4-4-authentication-bypass-vulnerability","description":"Authentication Bypass vulnerability found by Slavco in WordPress MainWP Child plugin (versions <=3.4.4).","date":"2018-03-02"}],"impact":[]},{"uuid":"c094ec49aa836c5a57cbbe71910a5949ee60610fc1fdae62a7b96283f326102c","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.9.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"616cec93d1e1a764d8c41e21c7de3acf2377dd0b","name":"WordPress MainWP Child Plugin <= 2.0.9.1 - Authentication Bypass","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mainwp-child\/vulnerability\/wordpress-mainwp-child-plugin-2-0-9-1-authentication-bypass","description":"Because of this vulnerability, anyone can log in as an administrator just by knowing the target user\u2019s handle (password bypass).\nUpdate this plugin.","date":"2015-03-09"}],"impact":[]},{"uuid":"67a420ff80b00150dc0dc7122b47c94bebc9d7bb1253212623394c679e6e0cdb","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.4.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"b30b040bed5fff76b548866fcb36373ce05819b7","name":"MainWP Child < 3.4.5 - Authentication Bypass","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mainwp-child\/mainwp-child-345-authentication-bypass","description":"The MainWP Child plugin for WordPress is vulnerable to authentication bypass due to insufficient validation on the check_login function in versions up to, and including, 3.4.4. This makes it possible for attackers to become administrative users and take full control of the affected website.","date":"2018-02-18"}],"impact":[]},{"uuid":"6fdb9fe6b09d451f3cbc83e469355cd3ef9bbb5bd1407b9070c5d4a5cf476aa8","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.28","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.28","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"a33dfc3859c3dd84f0be7b9d867ad3c9126b676a","name":"MainWP Child <= 2.0.27 - Multiple Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mainwp-child\/mainwp-child-2027-multiple-cross-site-scripting","description":"The MainWP Child plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.0.27 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.","date":"2015-09-07"}],"impact":[]},{"uuid":"fc012f11bfa47c4eae0ef2096f43b5985facf400cf187aecd608ecc9d811189a","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.23","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.23","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"7a73856bdc8b22cd2a3344224e88772141b62448","name":"MainWP Dashboard and MainWP Child <= 2.0.22 - Unspecified Vulnerability","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/mainwp-dashboard-and-mainwp-child-2022-unspecified-vulnerability","description":"Unspecified vulnerability in the MainWP Dashboard and MainWP Child plugins in versions up to and including 2.0.22 for WordPress has unspecified impact and remote attack vectors.","date":"2015-08-07"}],"impact":[]},{"uuid":"5036240fd5b172498ee9bd0d83484512e163a3a2465a0c53482689bea36efd01","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.9.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"78e6ba639f1e8c5367e32db28a7f3caaf96a6000","name":"MainWP Child \u2013 Securely connects sites to the MainWP WordPress Manager Dashboard < 2.0.9.2 - Authentication Bypass","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mainwp-child\/mainwp-child-securely-connects-sites-to-the-mainwp-wordpress-manager-dashboard-2092-authentication-bypass","description":"The MainWP Child \u2013 Securely connects sites to the MainWP WordPress Manager Dashboard plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.9.1. This is due to a missing credential check within the WordPress init hook. This makes it possible for unauthenticated attackers to log in as any user, including administrator-level accounts, if the attacker knows the username.","date":"2015-03-09"}],"impact":[]},{"uuid":"be8924e90e962f93fcbd2a346520e634a100e7efd3005ea670e7e0c1cd50fd65","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.23","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.23","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"1da32fc3-b911-4a4f-aabf-517ae621e2c3","name":"MainWP &lt;= 2.0.22 - Unspecified","link":"https:\/\/wpscan.com\/vulnerability\/1da32fc3-b911-4a4f-aabf-517ae621e2c3","description":"Email sent from vendor to users:\r\n\r\n&quot;Today we released updates to both the MainWP Dashboard (2.0.23) and MainWP Child (2.0.23) that contain additional security hardening for a possible issue found by Francois Harvey and reported through out White Hat Reward Program.\r\n\r\nWe encourage everyone to update both their MainWP Dashboard and Child site as soon as possible then follow the security hardening procedure that will be listed at the top of your MainWP Dashboard. Once you have completed the update the warning will go away.&quot;","date":null}],"impact":[]},{"uuid":"0801e1e926e54764928adca5c7f11713f9623f3f7d56fac85044cdd7cfadd7f5","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.4.5","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"e7124958-4769-46df-9ddd-e645066d9151","name":"MainWP Child &lt;= 3.4.4 - Authentication Bypass","link":"https:\/\/wpscan.com\/vulnerability\/e7124958-4769-46df-9ddd-e645066d9151","description":"Not authorized attacker could gain full control of target application if he knows the administrative user name. In case of openssl installed on the server then one request is enough and in case of md5 verification ~100k requests will do the job.","date":null}],"impact":[]},{"uuid":"e4fbd3c43b0f68a0990fb01dfda79e79604c85c2bade56cd21968dcc1ac2ecc6","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.0.9.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"6d3888c5-3716-44b8-b051-640bea855129","name":"MainWP Child &lt;= 2.0.9.1 - Authentication Bypass","link":"https:\/\/wpscan.com\/vulnerability\/6d3888c5-3716-44b8-b051-640bea855129","description":"The MainWP Child &ndash; Securely connects sites to the MainWP WordPress Manager Dashboard WordPress plugin was affected by an Authentication Bypass security vulnerability.","date":null}],"impact":[]},{"uuid":"b9847b4d307e97516b04c46a6582f5d3bc861db0255c385261875b77d687d4f9","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 4.4.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"4.4.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-3132","name":"CVE-2023-3132","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-3132","description":"[en] The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.","date":"2023-06-27"},{"id":"a6b7ed577be8723d7d8ef0831135a900b1fa7d07","name":"MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up Files","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mainwp-child\/mainwp-child-4411-information-disclosure-via-back-up-files","description":"The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.","date":"2023-06-23"},{"id":"72f1fce07589045c500d0e705b19378e50bf0654","name":"WordPress  MainWP Child Plugin  <= 4.4.1.1 is vulnerable to Sensitive Data Exposure","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mainwp-child\/vulnerability\/wordpress-mainwp-child-plugin-4-4-1-1-information-disclosure-via-back-up-files-vulnerability","description":"Update the WordPress MainWP Child plugin to the latest available version (at least 4.4.1.2).\nRobert Lockwood discovered and reported this Sensitive Data Exposure vulnerability in WordPress MainWP Child Plugin.  This vulnerability has been fixed in version 4.4.1.2.","date":"2023-06-26"},{"id":"fdfbe353-88a3-4f8a-a575-3cbfe9984565","name":"MainWP Child &lt; 4.4.1.1 - Sensitive File Disclosure","link":"https:\/\/wpscan.com\/vulnerability\/fdfbe353-88a3-4f8a-a575-3cbfe9984565","description":"The plugin uses an easily guessable path to store user files, bad actors could use that to access other users&#039; sensitive files.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"7.5","severity":"h","exploitable":"3.9","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"7.5","severity":"high","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"3.9","impact":"3.6"},"cwe":[{"cwe":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"4c879dd475d55830c7ae360a6a47188a73a011190a8670a9f88091b9efde0ba5","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 5.3.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.3.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-10783","name":"CVE-2024-10783","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-10783","description":"[en] The MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.","date":"2024-12-13"},{"id":"dce18cf3b599d6891fcc7b9fb925d6387427fe5a","name":"MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mainwp-child\/mainwp-child-52-missing-authorization-to-unauthenticated-privilege-escalation","description":"The MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.","date":"2024-12-12"},{"id":"444cf45ba87d0800d138c852db170d136f47353e","name":"WordPress MainWP Child Plugin <= 5.2 is vulnerable to Privilege Escalation","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/mainwp-child\/vulnerability\/wordpress-mainwp-child-plugin-5-2-missing-authorization-to-unauthenticated-privilege-escalation-vulnerability","description":"<p>WordPress MainWP Child Plugin <= 5.2 is vulnerable to Privilege Escalation<\/p><p>Software: MainWP Child<\/p><p>Fixed in version 5.3 <\/p><p>Affected Version <= 5.2<\/p><p>CVE: CVE-2024-10783<\/p>","date":"2024-12-12"},{"id":"EUVD-2024-33525","name":"EUVD-2024-33525","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-33525","description":"The MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note 5.2.1 contains a partial patch, though we consider 5.3 to be the complete patch.","date":"2024-12-13"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"h","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"8.1","severity":"h","exploitable":"2.2","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"8.1","severity":"high","av":"network","ac":"high","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.2","impact":"5.9"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null},"epss":"0.001"}},{"uuid":"2090e0400a078f9da244ebdede7fe8e4c370f50fb8ca2036a8a8ef0930f8bf95","name":"MainWP Child &#8211; Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 6.1.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"6.1.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-27366","name":"CVE-2026-27366","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-27366","description":"[en] Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.","date":"2026-06-25"},{"id":"ccb14c02b83554c39f350218d0024e00892f754a","name":"MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.1.1 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/mainwp-child\/mainwp-child-securely-connects-to-the-mainwp-dashboard-to-manage-multiple-sites-611-missing-authorization","description":"The MainWP Child \u2013 Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.1.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.","date":"2026-06-23"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"h","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"7.5","severity":"h","exploitable":"0.0","impact":"0.0"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"7.5","severity":"high","av":"network","ac":"high","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}}]},"updated":"1785997570"}