PLUGIN SECURITY
MainWP Child establishes a secure link between your WordPress sites and your self-hosted MainWP Dashboard, simplifying site management.
mainwp-childbackupsmonitoringsecuritysite managementupdate
4 known CVEs on file for MainWP Child. Reported between 2015 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-27366 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 6.1.2 | Missing Authorization | High 7.5 | < 6.1.2 | 6.1.2 | 2026-06-23 | — |
| CVE-2024-10783 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 5.3 | Missing Authorization | High 8.1 | < 5.3 | 5.3 | 2024-12-12 | — |
| CVE-2023-3132 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 4.4.1.2 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 4.4.1.2 | 4.4.1.2 | 2023-06-23 | — |
| CVE-2021-24877 | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 4.1.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 4.1.8 | 4.1.8 | 2021-10-25 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 | — | Unknown | < 3.4.5 | 3.4.5 | 2018-03-02 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 | — | Unknown | < 3.4.5 | 3.4.5 | 2018-02-18 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.28 | — | Unknown | < 2.0.28 | 2.0.28 | 2015-09-07 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.23 | — | Unknown | < 2.0.23 | 2.0.23 | 2015-08-07 | — |
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 6.1.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Source: Wordfence
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2 when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.
Source: CVE.org
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.4.1.1 due to insufficient controls on the storage of back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including the entire installations database if a backup occurs and the deletion of the back-up files fail.
Source: CVE.org
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
Source: CVE.org
Authentication Bypass vulnerability found by Slavco in WordPress MainWP Child plugin (versions <=3.4.4).
Source: Patchstack
The MainWP Child plugin for WordPress is vulnerable to authentication bypass due to insufficient validation on the check_login function in versions up to, and including, 3.4.4. This makes it possible for attackers to become administrative users and take full control of the affected website.
Source: Wordfence
The MainWP Child plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.0.27 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Source: Wordfence
Unspecified vulnerability in the MainWP Dashboard and MainWP Child plugins in versions up to and including 2.0.22 for WordPress has unspecified impact and remote attack vectors.
Source: Wordfence
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 | — | Unknown | < 2.0.9.2 | 2.0.9.2 | 2015-03-09 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 | — | Unknown | < 2.0.9.2 | 2.0.9.2 | 2015-03-09 | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.23 | — | Unknown | < 2.0.23 | 2.0.23 | — | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 3.4.5 | — | Unknown | < 3.4.5 | 3.4.5 | — | — |
| — | MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites [mainwp-child] < 2.0.9.2 | — | Unknown | < 2.0.9.2 | 2.0.9.2 | — | — |
Because of this vulnerability, anyone can log in as an administrator just by knowing the target user’s handle (password bypass). Update this plugin.
Source: Patchstack
The MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.9.1. This is due to a missing credential check within the WordPress init hook. This makes it possible for unauthenticated attackers to log in as any user, including administrator-level accounts, if the attacker knows the username.
Source: Wordfence
Email sent from vendor to users: "Today we released updates to both the MainWP Dashboard (2.0.23) and MainWP Child (2.0.23) that contain additional security hardening for a possible issue found by Francois Harvey and reported through out White Hat Reward Program. We encourage everyone to update both their MainWP Dashboard and Child site as soon as possible then follow the security hardening procedure that will be listed at the top of your MainWP Dashboard. Once you have completed the update the warning will go away."
Source: WPScan
Not authorized attacker could gain full control of target application if he knows the administrative user name. In case of openssl installed on the server then one request is enough and in case of md5 verification ~100k requests will do the job.
Source: WPScan
The MainWP Child – Securely connects sites to the MainWP WordPress Manager Dashboard WordPress plugin was affected by an Authentication Bypass security vulnerability.
Source: WPScan
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.