{
 "id": "WPSEC-2026-0936",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0936/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0936/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0936/index.md",
 "title": "MainWP Dashboard <= 6.2.2 - Authenticated (REST API Key Holder) Authentication Scope Bypass via Crafted Request URI",
 "description": "The MainWP Dashboard plugin for WordPress is vulnerable to Authentication Bypass via its REST API key authentication in versions 5.2 to 6.2.2. This is due to the plugin deciding whether to apply API key authentication by searching the raw REQUEST_URI for the '/wp-json/mainwp/' or '/wp-json/mainwp-' string, which also matches when that string appears in the query string of a request to any other endpoint. This makes it possible for holders of a MainWP REST API key to act as the key's owner, typically an administrator, on non-MainWP endpoints such as the WordPress core wp/v2 REST routes, and on requests outside the REST API such as admin-ajax.php, where the key's read or write restriction is not applied.",
 "plugin": {
  "slug": "mainwp",
  "name": "MainWP Dashboard",
  "full_name": "MainWP Dashboard: Self-hosted WordPress Management for Agencies",
  "wordpress_org": "https://wordpress.org/plugins/mainwp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mainwp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mainwp"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.2",
    "from_inclusive": true,
    "to": "6.2.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.2 before 6.2.3"
  ]
 },
 "introduced_in": "5.2",
 "fixed_in": "6.2.3",
 "remediation": "Update to 6.2.3 or later.",
 "fix_released": "2026-10-12T16:05:51+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:19:52.641810+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0936/",
  "https://plugins.svn.wordpress.org/mainwp/tags/6.2.3/",
  "https://wordpress.org/plugins/mainwp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mainwp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-14"
 }
}