blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24877

HIGH 7.2 CVSS 3.1
Published
November 23, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-89
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed

Affected products and versions

  • Unknown MainWP Child - Securely connects sites to the MainWP WordPress Manager Dashboard — From 4.1.8 (including) to 4.1.8 (excluding)
  • mainwp mainwp_child — Before 4.1.8

References

  • wpscan.com https://wpscan.com/vulnerability/b09fe120-ab9b-44f2-b50d-3b4b299d6d15 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record