WordPress Plugin Vulnerabilities
Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover
Description
The plugin injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value.
Proof of Concept
On any website where flo-launch is active create cookie "flo_custom_table_prefix" with any string value to initiate new WordPress instance setup. Complete setup and login as admin.
Affects Plugins
Fixed in 2.4.1 References
CVE
Classification
Type
ACCESS CONTROLS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Daniel Ruf
Submitter
Daniel Ruf
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2022-03-29 (about 1 years ago)
Added
2022-03-29 (about 1 years ago)
Last Updated
2022-04-11 (about 1 years ago)
WPScan 