{
 "id": "WPSEC-2026-2125",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2125/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2125/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2125/index.md",
 "title": "MainWP Dashboard <= 6.3 - Cross-Site Request Forgery to Bulk User Import via CSV Upload",
 "description": "The MainWP Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery via the bulk user import CSV upload in all versions up to, and including, 6.3, due to missing nonce validation in the render_bulk_upload() function. When the page receives an uploaded CSV file it renders the import and starts it automatically in the browser, which creates every user in the file on the selected child sites. This makes it possible for unauthenticated attackers to create user accounts of their choice, including administrators with passwords they set, on the connected child sites. The attacker must trick a logged-in Dashboard administrator into performing an action such as visiting a malicious page.",
 "plugin": {
  "slug": "mainwp",
  "name": "MainWP Dashboard",
  "full_name": "MainWP Dashboard: Self-hosted WordPress Management for Agencies",
  "wordpress_org": "https://wordpress.org/plugins/mainwp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mainwp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mainwp"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.4",
 "remediation": "Update to 6.4 or later.",
 "fix_released": "2026-10-29T16:13:51+00:00",
 "published": "2026-10-30T16:43:49+00:00",
 "updated": "2026-10-30T09:24:57.150778+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2125/",
  "https://plugins.svn.wordpress.org/mainwp/tags/6.4/",
  "https://wordpress.org/plugins/mainwp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mainwp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}