CVE-2022-0541

CVE-2022-0541: Flo Launch < 2.4.1 - Missing Authentication Allow Full Site Takeover

Vendor Unknown

Product flo-launch

Weakness CWE-284

Published April 25, 2022

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value.

Key dates

02Disclosure timeline

April 25, 2022 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-0541 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html

Related vulnerabilities

04Related CVE

CVE-2026-5526 Tenda 4G03 Pro httpd access control CVE-2026-32138 NEXULEAN API Key Leak CVE-2026-41006 Spring HATEOAS Collection+JSON/UBER deserializers do not honor Jackson configuration CVE-2023-21751 Azure DevOps Server Spoofing Vulnerability CVE-2024-1476 Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure