Vulnerabilities and security researches formainwp-child mainwp-child
Direction: ascendingJun 07, 2024
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # CVE-2021-24877
- CVE, Research URL
- Home page URL
- Date
- Nov 24, 2021
- Research Description
- The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
- Affected versions
-
max 4.1.8.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # CVE-2023-3132
- CVE, Research URL
- Home page URL
- Date
- Jun 27, 2023
- Research Description
- The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.
- Affected versions
-
max 4.4.1.2.
- Status
-
vulnerable
Dec 15, 2024
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # CVE-2024-10783
- CVE, Research URL
- Home page URL
- Date
- Dec 13, 2024
- Research Description
- The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.
- Affected versions
-
max 5.3.
- Status
-
vulnerable
Mar 30, 2026
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # PSC-2026-64637
- PSC, Research URL
- Home page URL
- Date
- Mar 30, 2026
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard (v6.0.5) is a WordPress plugin designed to establish a secure connection between individual WordPress sites and a self-hosted MainWP Dashboard. This architecture allows centralized management of multiple websites, including updates, backups, monitoring, and content administration. Built for websites running on WordPress, the plugin acts as a controlled communication bridge between managed sites and the MainWP Dashboard. Due to its role in remote management and cross-site communication, MainWP Child operates in a highly sensitive security context. As a result, a comprehensive security audit of its codebase and communication mechanisms was conducted.
- Affected versions
-
Min 6.2, max 6.2.
- Status
-
SAFE & CERTIFIED
Jun 16, 2026
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # 616cec93d1e1a764d8c41e21c7de3acf2377dd0b
- CVE, Research URL
- Home page URL
- Date
- Mar 09, 2015
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 WordPress MainWP Child Plugin <= 2.0.9.1 - Authentication Bypass Because of this vulnerability, anyone can log in as an administrator just by knowing the target user’s handle (password bypass). Update this plugin.
- Affected versions
-
max 2.0.9.2.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # 1da32fc3-b911-4a4f-aabf-517ae621e2c3
- CVE, Research URL
- Home page URL
- Date
- -
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.23 MainWP <= 2.0.22 - Unspecified Email sent from vendor to users: "Today we released updates to both the MainWP Dashboard (2.0.23) and MainWP Child (2.0.23) that contain additional security hardening for a possible issue found by Francois Harvey and reported through out White Hat Reward Program. We encourage everyone to update both their MainWP Dashboard and Child site as soon as possible then follow the security hardening procedure that will be listed at the top of your MainWP Dashboard. Once you have completed the update the warning will go away."
- Affected versions
-
max 2.0.23.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # 3d2e8b08ada72a6fa5d9b2d24a455546707f0736
- CVE, Research URL
- Home page URL
- Date
- Mar 02, 2018
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 WordPress MainWP Child plugin <=3.4.4 - Authentication Bypass vulnerability Authentication Bypass vulnerability found by Slavco in WordPress MainWP Child plugin (versions <=3.4.4).
- Affected versions
-
max 3.4.5.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # a33dfc3859c3dd84f0be7b9d867ad3c9126b676a
- CVE, Research URL
- Home page URL
- Date
- Sep 07, 2015
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.28 MainWP Child <= 2.0.27 - Multiple Cross-Site Scripting The MainWP Child plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.0.27 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
- Affected versions
-
max 2.0.28.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # 7a73856bdc8b22cd2a3344224e88772141b62448
- CVE, Research URL
- Home page URL
- Date
- Aug 07, 2015
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.23 MainWP Dashboard and MainWP Child <= 2.0.22 - Unspecified Vulnerability Unspecified vulnerability in the MainWP Dashboard and MainWP Child plugins in versions up to and including 2.0.22 for WordPress has unspecified impact and remote attack vectors.
- Affected versions
-
max 2.0.23.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # e7124958-4769-46df-9ddd-e645066d9151
- CVE, Research URL
- Home page URL
- Date
- -
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 MainWP Child <= 3.4.4 - Authentication Bypass Not authorized attacker could gain full control of target application if he knows the administrative user name. In case of openssl installed on the server then one request is enough and in case of md5 verification ~100k requests will do the job.
- Affected versions
-
max 3.4.5.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # 78e6ba639f1e8c5367e32db28a7f3caaf96a6000
- CVE, Research URL
- Home page URL
- Date
- Mar 09, 2015
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard < 2.0.9.2 - Authentication Bypass The MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.9.1. This is due to a missing credential check within the WordPress init hook. This makes it possible for unauthenticated attackers to log in as any user, including administrator-level accounts, if the attacker knows the username.
- Affected versions
-
max 2.0.9.2.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # 6d3888c5-3716-44b8-b051-640bea855129
- CVE, Research URL
- Home page URL
- Date
- -
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 MainWP Child <= 2.0.9.1 - Authentication Bypass The MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard WordPress plugin was affected by an Authentication Bypass security vulnerability.
- Affected versions
-
max 2.0.9.2.
- Status
-
vulnerable
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # b30b040bed5fff76b548866fcb36373ce05819b7
- CVE, Research URL
- Home page URL
- Date
- Feb 18, 2018
- Research Description
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 MainWP Child < 3.4.5 - Authentication Bypass The MainWP Child plugin for WordPress is vulnerable to authentication bypass due to insufficient validation on the check_login function in versions up to, and including, 3.4.4. This makes it possible for attackers to become administrative users and take full control of the affected website.
- Affected versions
-
max 3.4.5.
- Status
-
vulnerable
Jun 30, 2026
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # CVE-2026-27366
- CVE, Research URL
- Home page URL
- Date
- Jun 25, 2026
- Research Description
- Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.
- Affected versions
-
max 6.1.2.
- Status
-
vulnerable
Oct 09, 2026
MainWP Child – Securely Connects Sites to the MainWP WordPress Manager Dashboard # CVE-2026-105436
- CVE, Research URL
- Home page URL
- Date
- Oct 08, 2026
- Research Description
- Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
- Affected versions
-
max 6.2.2.
- Status
-
vulnerable