MainWP CVE-2026-57327

Exploitation requires a valid WordPress account at subscriber role or above on the target site running MainWP 6.1.1 or earlier. The subscriber role is the lowest default WordPress role, commonly assigned to registered users on membership or community sites; it is obtainable by anyone if user registration is enabled. The CVSS PR:L metric confirms low privilege suffices - no administrator or editor account is needed. Unauthenticated (anonymous) users cannot trigger this vulnerability; sites with user registration fully disabled and no active subscriber accounts are not exposed to external exploitation, though the flaw remains accessible to any internal authenticated user. No specific non-default configuration or particular feature enablement is described as required beyond the plugin being active.

The NVD CVSS score of 6.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L reflects a network-exploitable flaw requiring only subscriber-level authentication and no user interaction, but with limited per-impact outcomes (C:L/I:L/A:L) and no scope change. EPSS data is not provided in the available intelligence, so exploitation probability cannot be quantitatively compared. KEV status is not confirmed, and no POC is publicly referenced, meaning exploitation remains theoretical at time of analysis. The unchanged scope (S:U) limits blast radius to the vulnerable system itself and precludes lateral movement through the plugin alone. Real-world risk is elevated on sites with open user registration - where subscriber accounts are freely obtainable - and particularly significant given MainWP's role in managing multiple downstream WordPress sites, meaning a successful exploit on the management dashboard could have upstream administrative consequences. Sites with registration disabled and no untrusted subscriber accounts face substantially lower practical risk.

An attacker registers a free subscriber account on a WordPress site running MainWP 6.1.1 or earlier - trivially achievable on any site with open user registration - then submits a crafted HTTP POST request to an unprotected plugin endpoint intended for administrative use. The missing capability check allows the request to succeed, enabling the attacker to read sensitive site management data, modify plugin settings, or cause limited disruption. No public exploit code is identified at time of analysis, but the straightforward nature of WordPress capability-bypass exploitation makes manual proof-of-concept development accessible to moderately skilled attackers.