MainWP Dashboard <= 6.3 - Cross-Site Request Forgery to Bulk User Import via CSV Upload
- ID
- WPSEC-2026-2125
- Plugin
- MainWP Dashboard: Self-hosted WordPress Management for Agencies (mainwp)
- Affected
- all versions before 6.4
- Remediation
- Update to 6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- MainWP Dashboard on WPSec AttackSurface
- Fix released
- Published
Description
The MainWP Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery via the bulk user import CSV upload in all versions up to, and including, 6.3, due to missing nonce validation in the render_bulk_upload() function. When the page receives an uploaded CSV file it renders the import and starts it automatically in the browser, which creates every user in the file on the selected child sites. This makes it possible for unauthenticated attackers to create user accounts of their choice, including administrators with passwords they set, on the connected child sites. The attacker must trick a logged-in Dashboard administrator into performing an action such as visiting a malicious page.
References
- https://wpsec.com/vuln/WPSEC-2026-2125/
- https://plugins.svn.wordpress.org/mainwp/tags/6.4/
- https://wordpress.org/plugins/mainwp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS