What’s Vulnerable › Vulnerabilities

CVE-2021-24877: MainWP Child < 4.1.8 - Admin+ SQL Injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-23 · updated 2026-06-17
• Weakness: CWE-89

Description

The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed

Affected products

• MainWP Child: before 4.1.8 — fixed in 4.1.8

How to fix

Upgrade to a fixed version: MainWP Child 4.1.8. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/b09fe120-ab9b-44f2-b50d-3b4b299d6d15
• https://wpscan.com/vulnerability/b09fe120-ab9b-44f2-b50d-3b4b299d6d15

Get alerted when CVE-2021-24877 or the next vulnerability affects your stack