CVE-2022-0541
📋 TL;DR
The flo-launch WordPress plugin before version 2.4.1 contains an improper access control vulnerability that allows attackers to inject malicious code into wp-config.php by manipulating the flo_custom_table_prefix cookie. This enables attackers to initiate new WordPress site installations with arbitrary configurations, potentially leading to complete site compromise. All WordPress sites using vulnerable versions of the flo-launch plugin are affected.
💻 Affected Systems
- WordPress flo-launch plugin
📦 What is this software?
Flo Launch by Flothemes
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover: attacker gains administrative access, installs backdoors, steals sensitive data, and uses the site for further attacks.
Likely Case
Unauthorized site creation with attacker-controlled configuration, leading to data manipulation, malware injection, or credential theft.
If Mitigated
Limited impact if plugin is disabled or removed, though residual risk from any already-injected code.
🎯 Exploit Status
Exploitation is straightforward via cookie manipulation in HTTP requests. Public proof-of-concept code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.1
Vendor Advisory: https://wpscan.com/vulnerability/822cac2c-decd-4aa4-9e8e-1ba2d0c080ce
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'flo-launch' plugin. 4. Click 'Update Now' if available, or manually update to version 2.4.1+. 5. Verify update completes successfully.
🔧 Temporary Workarounds
Disable flo-launch plugin
allTemporarily disable the vulnerable plugin until patching is possible
wp plugin deactivate flo-launch
Remove flo-launch plugin
linuxCompletely remove the vulnerable plugin files
wp plugin delete flo-launch
rm -rf /path/to/wp-content/plugins/flo-launch/
🧯 If You Can't Patch
- Immediately disable the flo-launch plugin via WordPress admin or command line
- Implement web application firewall rules to block requests containing 'flo_custom_table_prefix' cookie manipulation
🔍 How to Verify
Check if Vulnerable:
Check WordPress plugin version: wp plugin list | grep flo-launch, or inspect /wp-content/plugins/flo-launch/readme.txt for version < 2.4.1Check Version:
wp plugin list | grep flo-launchVerify Fix Applied:
Confirm flo-launch plugin version is 2.4.1 or higher: wp plugin list | grep flo-launch📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'flo_custom_table_prefix' cookie containing unusual values
- Unexpected wp-config.php modifications
- New WordPress installation processes initiated
Network Indicators:
- HTTP POST requests to WordPress admin URLs with manipulated cookies
- Unusual traffic patterns to wp-admin/install.php
SIEM Query:
source="web_logs" AND (cookie="*flo_custom_table_prefix*" OR uri_path="*/wp-admin/install.php")