Vulnerabilities and security researches formainwp-child mainwp-child

Jun 07, 2024

CVE, Research URL: CVE-2021-24877
Home page URL: Security reports for MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard
Application: MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard
Date: Nov 24, 2021
Research Description: The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
Affected versions: max 3.4.5.
Status: vulnerable

CVE, Research URL: CVE-2023-3132
Home page URL: Security reports for MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard
Application: MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard
Date: Jun 27, 2023
Research Description: The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.
Affected versions: max 4.4.1.2.
Status: vulnerable

Dec 15, 2024

CVE, Research URL: CVE-2024-10783
Home page URL: Security reports for MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard
Application: MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard
Date: Dec 13, 2024
Research Description: The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note 5.2.1 contains a partial patch, though we consider 5.3 to be the complete patch.
Affected versions: max 5.3.
Status: vulnerable