CVE-2024-10783
Published: 13 December 2024
Summary
CVE-2024-10783 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 10.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The MainWP Child plugin for WordPress, which securely connects sites to the MainWP Dashboard for multi-site management, contains a privilege escalation vulnerability. It stems from missing authorization checks on the register_site function in all versions through 5.2. The flaw is present only when a site remains in an unconfigured state without the unique security ID feature enabled; sites already connected to the Dashboard are unaffected regardless of the security ID setting.
Unauthenticated remote attackers can exploit the issue over the network to register a site and obtain administrator-level access on vulnerable instances. The CVSS 8.1 score reflects the high impact on confidentiality, integrity, and availability when the attack succeeds, although exploitation requires the specific unconfigured condition and carries elevated attack complexity.
Public references point to code-level changesets in the WordPress plugin repository that address the authorization gap. The vendor released fixes in version 5.3.4 after an earlier attempt in 5.3.3 was bypassed; administrators are advised to update immediately and ensure the unique security ID is enabled on any remaining unconnected installations.
EPSS for the CVE rose sharply from a low baseline to a peak of 0.4059, indicating emerging exploitation interest after disclosure before receding to the current value of 0.0440.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33525
Vulnerability details
The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the register_site function in all versions up to, and including, 5.2…
more
when a site is left in an unconfigured state. This makes it possible for unauthenticated attackers to log in as an administrator on instances where MainWP Child is not yet connected to the MainWP Dashboard. IMPORTANT: this only affects sites who have MainWP Child installed and have not yet connected to the MainWP Dashboard, and do not have the unique security ID feature enabled. Sites already connected to the MainWP Dashboard plugin and do not have the unique security ID feature enabled, are NOT affected and not required to upgrade. Please note versions up to 5.3.3 contained a patch, though a bypass was discovered and not addressed until version 5.3.4.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring an access control policy ensures authorization checks are defined and applied for critical functions.
Reviews of access controls detect missing authorization checks on critical functions or resources.
Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.
Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
The control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
Requiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.