MainWP Vulnerabilities and Affected Products
Vulnerabilities associated with MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites.
Products
Clear product- MainWP Child Reports3 vulnerabilities
- MainWP Dashboard: Self-hosted WordPress Management for Agencies3 vulnerabilities
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites2 vulnerabilities
- MainWP Code Snippets Extension2 vulnerabilities
- MainWP1 vulnerability
- MainWP Broken Links Checker Extension1 vulnerability
- MainWP Child1 vulnerability
- MainWP Dashboard -The Private WordPress Manager for Multiple Website Maintenance Plugin1 vulnerability
- MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance1 vulnerability
- MainWP File Uploader Extension1 vulnerability
- MainWP Google Analytics Extension1 vulnerability
- MainWP Links Manager Extension1 vulnerability
- MainWP Maintenance Extension1 vulnerability
- MainWP Matomo Extension1 vulnerability
- MainWP Staging Extension1 vulnerability
- MainWP UpdraftPlus Extension1 vulnerability
- MainWP Wordfence Extension1 vulnerability
- mainwp_file_uploader_extension1 vulnerability
- mainwp_links_manager_extension1 vulnerability
- mainwp_updraftplus_extension1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-10783HIGH | MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege EscalationThe MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who… | CVSS8.1v3.1 | EPSS2.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2023-3132MEDIUM | MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up FilesThe MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail. CWE-200Jun 27, 2023 | CVSS5.9v3.1 | EPSS0.662% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |