Vulnerabilities / MainWP Dashboard / WPSEC-2026-0935
MainWP Dashboard <= 6.2.2 - Insufficient Session Expiration via REST API Keys of Deleted or Removed Users
Medium 5.9
CWE-613Fixed in 6.2.3
- ID
- WPSEC-2026-0935
- Plugin
- MainWP Dashboard: Self-hosted WordPress Management for Agencies (mainwp)
- Affected
- from 5.2 before 6.2.3
- Remediation
- Update to 6.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-613
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- MainWP Dashboard on WPSec AttackSurface
- Fix released
- Published
Description
The MainWP Dashboard plugin for WordPress is vulnerable to Insufficient Session Expiration via REST API keys in versions 5.2 to 6.2.2. This is due to the plugin not revoking a user's REST API keys when that user is deleted or removed from the site, and not checking at authentication time that the key's owner still exists. This makes it possible for former users who kept a REST API key to keep using the MainWP REST API, and through it the connected child sites, after their account has been removed.
References
- https://wpsec.com/vuln/WPSEC-2026-0935/
- https://plugins.svn.wordpress.org/mainwp/tags/6.2.3/
- https://wordpress.org/plugins/mainwp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS