Unauthenticated Attackers Can Escalate Privileges in MainWP Child Plugin

CVE-2024-10783

Summary

A privilege escalation vulnerability exists in the MainWP Child plugin for WordPress, affecting all versions up to and including 5.2. This vulnerability stems from missing authorization checks in the register_site function, particularly when a site remains in an unconfigured state. Unauthenticated attackers can potentially exploit this flaw to log in as an administrator on sites where the MainWP Child plugin is installed but not connected to the MainWP Dashboard. Notably, sites employing the unique security ID feature or already connected to the dashboard are not impacted. Version 5.2.1 provides a partial fix, while version 5.3 offers a complete resolution to the vulnerability.

References