MainWP Dashboard <= 6.2.2 - Authenticated (REST API Key Holder) Authentication Scope Bypass via Crafted Request URI
- ID
- WPSEC-2026-0936
- Plugin
- MainWP Dashboard: Self-hosted WordPress Management for Agencies (mainwp)
- Affected
- from 5.2 before 6.2.3
- Remediation
- Update to 6.2.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- MainWP Dashboard on WPSec AttackSurface
- Fix released
- Published
Description
The MainWP Dashboard plugin for WordPress is vulnerable to Authentication Bypass via its REST API key authentication in versions 5.2 to 6.2.2. This is due to the plugin deciding whether to apply API key authentication by searching the raw REQUEST_URI for the '/wp-json/mainwp/' or '/wp-json/mainwp-' string, which also matches when that string appears in the query string of a request to any other endpoint. This makes it possible for holders of a MainWP REST API key to act as the key's owner, typically an administrator, on non-MainWP endpoints such as the WordPress core wp/v2 REST routes, and on requests outside the REST API such as admin-ajax.php, where the key's read or write restriction is not applied.
References
- https://wpsec.com/vuln/WPSEC-2026-0936/
- https://plugins.svn.wordpress.org/mainwp/tags/6.2.3/
- https://wordpress.org/plugins/mainwp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS