Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2024-1642: The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is d...
CVE-2024-1642 · published 2 years ago
Summary
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for ...
What to do
- Update mainwp mainwp_dashboard to version 5.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mainwp | mainwp_dashboard |
< 5.0 cpe:2.3:a:mainwp:mainwp_dashboard:*:*:*:*:*:wordpress:*:* |
Original advisory text
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is d...
The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published13 Mar 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-1642 · NVD
Track software like this
Free during beta