Read the docs
TI-2021-07159 Aliases CVE-2021-24877GHSA-jq58-mjxh-8fp7

MainWP Child < 4.1.8 - Admin+ SQL Injection

Priority LOW 34CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed

Why it matters now

EPSS 0.01279 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed MainWP Child - Securely connects sites to the MainWP WordPress Manager Dashboard (Unknown): 4.1.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownMainWP Child - Securely connects sites to the MainWP WordPress Manager Dashboard4.1.8 to before 4.1.84.1.8Patch availableCNA
  • MainWP Child - Securely connects sites to the MainWP WordPress Manager Dashboard VendorUnknown Affected 4.1.8 to before 4.1.8 Fixed in 4.1.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mainwp:mainwp_child:*:*:*:*:*:wordpress:*:*before 4.1.8VulnerableMainWP
  • cpe:2.3:a:mainwp:mainwp_child:*:*:*:*:*:wordpress:*:* Versions before 4.1.8 Vulnerable ·MainWP

Remediation

  • Fix · CNA MainWP Child - Securely connects sites to the MainWP WordPress Manager Dashboard (Unknown) Fixed in 4.1.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24877
  2. 2026-10-03 Alias added: GHSA-jq58-mjxh-8fp7

References

Exploit 1

  • TI-2024-06942 MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update CVSS 3.1HIGH 8.8
  • TI-2023-02935 MainWP Child <= 4.4.1.1 - Information Disclosure via Back-Up Files CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences