{
 "id": "WPSEC-2026-0935",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0935/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0935/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0935/index.md",
 "title": "MainWP Dashboard <= 6.2.2 - Insufficient Session Expiration via REST API Keys of Deleted or Removed Users",
 "description": "The MainWP Dashboard plugin for WordPress is vulnerable to Insufficient Session Expiration via REST API keys in versions 5.2 to 6.2.2. This is due to the plugin not revoking a user's REST API keys when that user is deleted or removed from the site, and not checking at authentication time that the key's owner still exists. This makes it possible for former users who kept a REST API key to keep using the MainWP REST API, and through it the connected child sites, after their account has been removed.",
 "plugin": {
  "slug": "mainwp",
  "name": "MainWP Dashboard",
  "full_name": "MainWP Dashboard: Self-hosted WordPress Management for Agencies",
  "wordpress_org": "https://wordpress.org/plugins/mainwp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mainwp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mainwp"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-613"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.2",
    "from_inclusive": true,
    "to": "6.2.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.2 before 6.2.3"
  ]
 },
 "introduced_in": "5.2",
 "fixed_in": "6.2.3",
 "remediation": "Update to 6.2.3 or later.",
 "fix_released": "2026-10-12T16:05:51+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:19:52.641810+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0935/",
  "https://plugins.svn.wordpress.org/mainwp/tags/6.2.3/",
  "https://wordpress.org/plugins/mainwp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mainwp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}