# MainWP Dashboard <= 6.2.2 - Authenticated (REST API Key Holder) Authentication Scope Bypass via Crafted Request URI

- **ID:** WPSEC-2026-0936
- **Plugin:** MainWP Dashboard: Self-hosted WordPress Management for Agencies (`mainwp`), https://wordpress.org/plugins/mainwp/
- **Affected versions:** from 5.2 before 6.2.3
- **Fixed in:** 6.2.3 (Update to 6.2.3 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mainwp
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0936/

## Description

The MainWP Dashboard plugin for WordPress is vulnerable to Authentication Bypass via its REST API key authentication in versions 5.2 to 6.2.2. This is due to the plugin deciding whether to apply API key authentication by searching the raw REQUEST_URI for the '/wp-json/mainwp/' or '/wp-json/mainwp-' string, which also matches when that string appears in the query string of a request to any other endpoint. This makes it possible for holders of a MainWP REST API key to act as the key's owner, typically an administrator, on non-MainWP endpoints such as the WordPress core wp/v2 REST routes, and on requests outside the REST API such as admin-ajax.php, where the key's read or write restriction is not applied.

## References

- https://wpsec.com/vuln/WPSEC-2026-0936/
- https://plugins.svn.wordpress.org/mainwp/tags/6.2.3/
- https://wordpress.org/plugins/mainwp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0936/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.