MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites <= 6.3 - Unauthenticated Authentication Bypass via Signed Request Replay
- ID
- WPSEC-2026-2127
- Plugin
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites (mainwp-child)
- Affected
- all versions before 6.4
- Remediation
- Update to 6.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-294
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites on WPSec AttackSurface
- Fix released
- Published
Description
The MainWP Child plugin for WordPress is vulnerable to Authentication Bypass by Capture-Replay via the legacy 'mainwpsignature' request signature in all versions up to, and including, 6.3, due to the replay protection keying used and blocked signatures on the raw request value while the signature is verified after lenient base64 decoding, which ignores characters outside the base64 alphabet. Because a legacy signature covers only the requested function and nonce, and not the other request parameters such as the 'user' of a login_required request, this makes it possible for unauthenticated attackers who have obtained one validly signed Dashboard request or login link to resend it again and again with different spellings of the same signature, run the signed Dashboard function on the child site with parameters they choose, and potentially log in as an administrator.
References
- https://wpsec.com/vuln/WPSEC-2026-2127/
- https://plugins.svn.wordpress.org/mainwp-child/tags/6.4/
- https://wordpress.org/plugins/mainwp-child/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS