Executive brief
The FleekDash V2 plugin for WordPress, used for dashboard management, contains a critical security flaw that allows unauthorized users to take over any account on the site. By exploiting this vulnerability, an attacker can change the email and password of any user, including site administrators. This can lead to a total loss of control over the website and the exposure of sensitive customer data.
Technical details
The FleekDash V2 plugin for WordPress (up to version 2.6.2.2) fails to implement proper authorization checks in its user management logic. Specifically, the plugin does not verify if a user has the necessary permissions before allowing them to modify account details. While the primary vulnerability requires subscriber-level authentication, a secondary issue in the '/wp-json/fleekdash/v1/register' endpoint allows unauthenticated attackers to self-provision a subscriber account and obtain a valid REST nonce, even if site registration is disabled. Once authenticated, an attacker can send a request to overwrite the email address and password of any user, including administrators, resulting in complete account takeover.
Affected products
- fleekdash FleekDash V2 <= 2.6.2.2
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory