Mainwp
CVE-2023-23651
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions.
AnalysisAI
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions. Affected products include: Mainwp Mainwp Google Analytics Extension.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it
The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc
Auth. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch
Cross-Site Request Forgery (CSRF) vulnerability in MainWP Matomo Extension <= 4.0.4 versions. Rated high severity (CVSS
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dash
Broken access control in the MainWP Child WordPress plugin (versions 6.1.1 and earlier) allows remote attackers to invok
Broken access control in MainWP WordPress plugin versions 6.1.1 and below allows authenticated subscribers to bypass aut
The MainWP Child plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including,
Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.1.1. Rated medium severity (CVSS 5.4), th
Missing Authorization vulnerability in MainWP MainWP Wordfence Extension.0.7. Rated medium severity (CVSS 5.4), this vul
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today