The MainWP Child plugin for WordPress suffers from a missing authorization check (CWE-862) in its register_site function, enabling privilege escalation when the plugin is unconfigured and the unique security ID feature is disabled. This vulnerability allows unauthenticated attackers to gain administrator access on affected sites. The issue impacts all versions up to 5.2. Although a patch was released by version 5.3.3, a bypass was discovered and only addressed in version 5.3.4. Sites already connected to the MainWP Dashboard or using the unique security ID feature are not vulnerable.

Successful exploitation results in an unauthenticated attacker gaining administrator privileges on vulnerable WordPress sites running the MainWP Child plugin in an unconfigured state without the unique security ID feature enabled. This can lead to full site compromise, including confidentiality, integrity, and availability impacts. Sites that are already connected to the MainWP Dashboard or have the unique security ID feature enabled are not impacted. No known exploits have been reported in the wild to date.

Upgrade the MainWP Child plugin to version 5.3.4 or later, which contains the official fix addressing the bypass and missing authorization checks. Sites that are already connected to the MainWP Dashboard or have the unique security ID feature enabled are not vulnerable and do not require immediate action. Patch status is confirmed by the vendor's versioning information. Check the vendor advisory for the latest updates and ensure the plugin is configured and connected properly to the MainWP Dashboard.