What is the CVSS score of CVE-2026-57327?

CVE-2026-57327 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

MainWP CVE-2026-57327

Q: Which versions of MainWP are affected by CVE-2026-57327?

Broken access control in MainWP WordPress plugin versions 6.1.1 and below allows authenticated subscribers to bypass authorization checks and perform actions restricted to higher-privileged roles.

EUVD-2026-40098 MEDIUM

Missing Authorization (CWE-862)

2026-06-29 Patchstack

GHSA-jqjh-8jhc-v62j

WordPress Authentication Bypass Mainwp Wordpress Plugin

6.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint with subscriber-level auth (PR:L) sufficient; low C/I/A reflects partial access/modification, not full administrative compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:21 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in MainWP <= 6.1.1 versions.

AnalysisAI

Broken access control in MainWP WordPress plugin versions 6.1.1 and below allows authenticated subscribers to bypass authorization checks and perform actions restricted to higher-privileged roles. The CVSS vector (PR:L, AC:L, AV:N) confirms any low-privileged WordPress account - the subscriber role being the lowest default - is sufficient for network-based exploitation with no special complexity. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the minimal barrier to obtaining a subscriber account on sites with open registration makes this a meaningful risk for multi-user or membership-based installations.

Technical ContextAI

MainWP is a WordPress plugin designed to centrally manage multiple WordPress child sites from a single dashboard, making it a high-value target in WordPress administrative contexts. CWE-862 (Missing Authorization) identifies the root cause: certain plugin endpoints or AJAX action handlers fail to perform capability checks before executing privileged operations. WordPress defines a role hierarchy where the subscriber role carries almost no inherent capabilities; any action accessible to subscribers that was intended for editors or administrators represents a privilege escalation path. The CPE string cpe:2.3:a:mainwp:mainwp:*:*:*:*:*:*:*:* scopes all MainWP releases, with the vulnerability ceiling confirmed at 6.1.1 by Patchstack reporting.

RemediationAI

Update the MainWP plugin to any version released after 6.1.1; the exact patched release should be verified via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mainwp/vulnerability/wordpress-mainwp-plugin-6-1-1-broken-access-control-vulnerability, as a specific fix version is not confirmed in the available intelligence. If immediate patching is not feasible, disabling public user registration on the WordPress site will prevent external actors from obtaining the subscriber accounts required for exploitation - note this does not protect against existing or internal subscriber accounts. Auditing and removing unnecessary low-privilege accounts reduces the attack surface further, though neither workaround eliminates the underlying missing authorization flaw.