# MainWP Dashboard <= 6.2.2 - Insufficient Session Expiration via REST API Keys of Deleted or Removed Users

- **ID:** WPSEC-2026-0935
- **Plugin:** MainWP Dashboard: Self-hosted WordPress Management for Agencies (`mainwp`), https://wordpress.org/plugins/mainwp/
- **Affected versions:** from 5.2 before 6.2.3
- **Fixed in:** 6.2.3 (Update to 6.2.3 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-613
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mainwp
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0935/

## Description

The MainWP Dashboard plugin for WordPress is vulnerable to Insufficient Session Expiration via REST API keys in versions 5.2 to 6.2.2. This is due to the plugin not revoking a user's REST API keys when that user is deleted or removed from the site, and not checking at authentication time that the key's owner still exists. This makes it possible for former users who kept a REST API key to keep using the MainWP REST API, and through it the connected child sites, after their account has been removed.

## References

- https://wpsec.com/vuln/WPSEC-2026-0935/
- https://plugins.svn.wordpress.org/mainwp/tags/6.2.3/
- https://wordpress.org/plugins/mainwp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0935/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.