CVE-2024-10783: MainWP Child Plugin Privilege Escalation

CVE-2024-10783 Overview

The MainWP Child plugin for WordPress contains a privilege escalation vulnerability in the register_site function. The flaw stems from missing authorization checks [CWE-862] and affects all versions up to and including 5.2, with an incomplete fix in versions up to 5.3.3. Unauthenticated attackers can log in as administrators on instances where MainWP Child is installed but not yet connected to the MainWP Dashboard and the unique security ID feature is disabled.

Critical Impact
Unauthenticated remote attackers can gain WordPress administrator access on unconfigured MainWP Child installations, leading to full site takeover.

Affected Products

MainWP Child – Securely Connects to the MainWP Dashboard plugin, versions up to and including 5.2
MainWP Child versions 5.3 through 5.3.3 (patch bypass)
WordPress sites with MainWP Child installed but not yet connected to the MainWP Dashboard

Discovery Timeline

2024-12-13 - CVE CVE-2024-10783 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10783

Vulnerability Analysis

The MainWP Child plugin connects WordPress sites to a central MainWP Dashboard for multi-site administration. During initial setup, the plugin exposes the register_site function to handle the connection handshake from the dashboard. This function fails to perform proper authorization checks when the plugin is in an unconfigured state.

An attacker who reaches a vulnerable WordPress site before legitimate dashboard pairing can invoke the registration flow and assert administrator credentials. The vendor shipped an initial patch through version 5.3.3, but a bypass was discovered and remained exploitable until version 5.3.4 closed the gap.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862] in the registration handler. The plugin treats the pre-connection state as an implicit trust boundary, assuming only the legitimate dashboard owner will reach the endpoint first. No nonce validation, IP restriction, or out-of-band secret is enforced unless the optional unique security ID feature is enabled.

Attack Vector

Exploitation occurs over the network against any WordPress site with the plugin freshly installed and not yet linked to a dashboard. The attacker sends a crafted request to the registration endpoint, supplying attacker-controlled parameters that the plugin accepts as the legitimate pairing request. The handler then issues an administrator session for the attacker, granting full control over the WordPress instance.

The vulnerability does not affect sites already connected to a MainWP Dashboard, nor sites with the unique security ID feature enabled. See the Wordfence Vulnerability Intelligence entry and WordPress Plugin Code Reference for technical details on the affected handler.

Detection Methods for CVE-2024-10783

Indicators of Compromise

Unexpected administrator accounts created on WordPress sites running MainWP Child
HTTP POST requests to MainWP Child registration endpoints from unrecognized IP addresses prior to legitimate dashboard pairing
Authentication log entries showing administrator logins without a corresponding wp-login.php request
Newly installed plugins, themes, or modified core files following an unauthenticated registration request

Detection Strategies

Audit all WordPress sites for installations of MainWP Child below version 5.3.4 and verify whether each site has completed dashboard pairing
Monitor web server access logs for requests targeting MainWP Child connection parameters such as function=register
Compare the WordPress wp_users and wp_usermeta tables against a known-good baseline to identify rogue administrator accounts

Monitoring Recommendations

Forward WordPress audit logs and web server access logs to a centralized SIEM for correlation across multi-site fleets
Alert on creation of WordPress users with the administrator role outside change windows
Track plugin version inventory across managed sites to identify installations still running affected MainWP Child releases

How to Mitigate CVE-2024-10783

Immediate Actions Required

Update MainWP Child to version 5.3.4 or later on every WordPress site where the plugin is installed
Complete the MainWP Dashboard pairing immediately after installation, or deactivate the plugin until pairing is performed
Enable the unique security ID feature in MainWP Child settings to add a secret required for the connection handshake
Review WordPress administrator accounts and revoke any unrecognized users created since the plugin was installed

Patch Information

The vendor addressed the original vulnerability in version 5.3.3, but a bypass remained exploitable until version 5.3.4. Administrators must upgrade to 5.3.4 or later; earlier patched releases are insufficient. Refer to the WordPress MainWP Child Plugin page for the current release and the WordPress Code Changeset for the corrective commit.

Workarounds

Deactivate MainWP Child on any site that has not yet been connected to a MainWP Dashboard until the upgrade can be applied
Restrict access to the WordPress site at the web server or WAF layer until pairing is completed and the plugin is updated
Enable the unique security ID feature so that registration requests without the shared secret are rejected

bash

# Upgrade MainWP Child via WP-CLI on each managed site
wp plugin update mainwp-child --version=5.3.4
wp plugin list --name=mainwp-child --fields=name,status,version