CVE-2021-24877
MainWP Child < 4.1.8 - Admin+ SQL Injection
CVE-2021-24877 is a high vulnerability (CVSS 7.2) in Mainwp Child, published November 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.28%, the 70th percentile. No source names a fixed version.
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
- Record
CVE-2021-24877- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
MainWP Child < 4.1.8 - Admin+ SQL Injection
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
- Record
CVE-2021-24877- Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2021-11789 No score
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
- Record
EUVD-2021-11789- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jq58-mjxh-8fp7 No score
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter...
The MainWP Child WordPress plugin before 4.1.8 does not validate the orderby and order parameter before using them in a SQL statement, leading to an SQL injection exploitable by high privilege users such as admin when the Backup and Staging by WP Time Capsule plugin is installed
- Record
GHSA-jq58-mjxh-8fp7- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |