MainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MainWP | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | up to 5.3.3 | — | No fix listed | CNA |
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites VendorMainWP Affected up to 5.3.3 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10783
- 2026-10-03 Alias added: GHSA-qrwv-895c-pv4v
References
Other 7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9156e536-a58e-4d78-b136-af8a9613ee23?source=cve
- https://plugins.trac.wordpress.org/browser/mainwp-child/tags/5.2/class/class-mainwp-child.php#L76
- https://plugins.trac.wordpress.org/browser/mainwp-child/tags/5.2/class/class-mainwp-connect.php#L69
- https://plugins.trac.wordpress.org/browser/mainwp-child/tags/5.2/class/class-mainwp-connect.php#L788
- https://wordpress.org/plugins/mainwp-child/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3197586%40mainwp-child&new=3197586%40mainwp-child&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3229741%40mainwp-child&new=3229741%40mainwp-child&sfp_email=&sfph_mail=
More MainWP vulnerabilities
- TI-2023-09477 WordPress MainWP File Uploader Extension Plugin <= 4.1 - Unauthenticated Arbitrary File Upload Vulnerability CVSS 3.1CRITICAL 10.0
- TI-2023-09550 WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2023-09470 Code injection in MainWP Code Snippets Extension CVSS 3.1CRITICAL 9.9
- TI-2026-69632 Object injection in MainWP Child WordPress plugin CVSS 3.1HIGH 8.8
- TI-2023-09480 WordPress MainWP Maintenance Extension Plugin <= 4.1.1 is vulnerable to SQL Injection CVSS 3.1HIGH 8.8
- TI-2023-09475 WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 - SQL Injection vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2024-10783 · CVE Program
- CVE-2024-10783 · NVD
- FIRST EPSS
- GHSA-qrwv-895c-pv4v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences