MainWP Child 6.2.2 Security Update

We have released an important security update for MainWP Child that affects its Clone/Restore functionality.

The issue was responsibly reported by Rafie Muhammad⁠ through MainWP’s security program on Patchstack. We thank them for following responsible disclosure practices.

At the time of publication, we are not aware of any active exploitation of this vulnerability.

What Was the Issue?

During a Clone/Restore operation, MainWP Child processes stored database values so site URLs can be updated correctly.

Under specific conditions, specially crafted content stored in the source site’s database could be processed unsafely. If an administrator later cloned or restored that site, the crafted content could potentially cause unauthorized code to execute during the restore process.

The issue is not triggered when the content is originally submitted. Exploitation requires a subsequent Clone/Restore operation initiated by an administrator.

How to Resolve It

Update MainWP Child to version 6.2.2 or later on all sites running MainWP Child before performing another Clone/Restore operation.

No configuration changes are required after updating.

If you cannot update immediately, do not perform Clone/Restore operations until the update has been installed.

Am I Already Compromised?

Running an affected version of MainWP Child does not mean that your site has been compromised.

Exploitation requires specially crafted content to already be present in the database and a subsequent Clone/Restore operation to process that content.

If you recently performed a Clone/Restore operation and have concerns, we recommend reviewing the restored site for unexpected administrator accounts, unfamiliar files or plugins, and other unexplained changes. You may also contact MainWP Support for assistance.

We recommend updating MainWP Child to version 6.2.2 or later as soon as possible.