CVE-2021-24877: 
WordPress vulnerability analysis and mitigation

CVE-2021-24877 is a SQL injection vulnerability discovered in the MainWP Child WordPress plugin versions below 4.1.8. The vulnerability was discovered by ZhongFu Su(JrXnm) of Wuhan University and was publicly disclosed on October 25, 2021. This security flaw affects the MainWP Child plugin when used in conjunction with the Backup and Staging by WP Time Capsule plugin (WPScan).

The vulnerability stems from improper validation of the 'orderby' and 'order' parameters in SQL statements. When exploited, this SQL injection vulnerability can be triggered by users with high privileges, such as administrators. The vulnerability has been assigned a CVSS score of 6.8 (medium severity) and is classified under CWE-89, falling into the OWASP Top 10 category A1: Injection (WPScan).

The vulnerability allows authenticated users with administrative privileges to perform SQL injection attacks against the affected WordPress installations. This could potentially lead to unauthorized database access and manipulation when the Backup and Staging by WP Time Capsule plugin is installed (WPScan).

The vulnerability has been fixed in MainWP Child version 4.1.8. Users are advised to update to this version or later to mitigate the risk (WPScan).