MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.1.1 - Missing Authorization
medium
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.1.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.
- CVSS:
- 5.3
- Affected:
- up to 6.1.1
- Fixed in:
- 6.1.2
- Disclosed:
- Jun 23, 2026
CVE-2026-27366 on NVD →
MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation
high
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possi...
- CVSS:
- 8.1
- Affected:
- up to 5.3.3
- Fixed in:
- 5.3.4
- Disclosed:
- Dec 12, 2024
CVE-2024-10783 on NVD →
MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up Files
medium
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a ba...
- CVSS:
- 5.9
- Affected:
- up to 4.4.1.1
- Fixed in:
- 4.4.1.2
- Disclosed:
- Jun 23, 2023
CVE-2023-3132 on NVD →
MainWP Child <= 4.1.7.1 - SQL Injection via orderby, order Parameters
high
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
- CVSS:
- 7.2
- Affected:
- up to 4.1.8
- Fixed in:
- 4.1.8
- Disclosed:
- Oct 25, 2021
CVE-2021-24877 on NVD →
MainWP Child < 3.4.5 - Authentication Bypass
high
The MainWP Child plugin for WordPress is vulnerable to authentication bypass due to insufficient validation on the check_login function in versions up to, and including, 3.4.4. This makes it possible for attackers to become administrative users and take full control of the affected website.
- CVSS:
- 8.3
- Affected:
- up to 3.4.5
- Fixed in:
- 3.4.5
- Disclosed:
- Feb 18, 2018
MainWP Child <= 2.0.27 - Multiple Cross-Site Scripting
medium
The MainWP Child plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.0.27 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
- CVSS:
- 6.1
- Affected:
- up to 2.0.27
- Fixed in:
- 2.0.28
- Disclosed:
- Sep 7, 2015
MainWP Dashboard and MainWP Child <= 2.0.22 - Unspecified Vulnerability
high
Unspecified vulnerability in the MainWP Dashboard and MainWP Child plugins in versions up to and including 2.0.22 for WordPress has unspecified impact and remote attack vectors.
- CVSS:
- 7.3
- Affected:
- up to 2.0.22
- Fixed in:
- 2.0.23
- Disclosed:
- Aug 7, 2015
MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard < 2.0.9.2 - Authentication Bypass
critical
The MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.9.1. This is due to a missing credential check within the WordPress init hook. This makes it possible for unauthenticated attackers to lo...
- CVSS:
- 9.8
- Affected:
- up to 2.0.9.2
- Fixed in:
- 2.0.9.2
- Disclosed:
- Mar 9, 2015
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database