Target Policy

Structured Scope

• Asset Identifier

  Asset Type

  Max Severity

• https://github.com/mainwp/mainwp

  ---

  We are specifically looking for security violations that would enable access to the users “Network” by a third party when a connection between the MainWP Dashboard and MainWP Child Plugin has already been established. This includes but is not limited to Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF/XSRF), Broken Authentication, Remote Code Execution SQL injection, and Privilege Escalation.

  We are generally not interested in DoS vulnerabilities that are perceived by a lack of rate-limiting or captcha.

  SOURCE_CODE

  critical
• https://github.com/mainwp/mainwp-child

  ---

  We are specifically looking for security violations that would enable access to the users “Network” by a third party when a connection between the MainWP Dashboard and MainWP Child Plugin has already been established. This includes but is not limited to Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF/XSRF), Broken Authentication, Remote Code Execution SQL injection, and Privilege Escalation.

  We are generally not interested in DoS vulnerabilities that are perceived by a lack of rate-limiting or captcha.

  SOURCE_CODE

  critical

• Download wordlist

Last Finished Scan: