LiteSpeed Cache CVE-2024-28000

Target must be a WordPress site running the LiteSpeed Cache plugin at version 6.3.0.1 or earlier with the plugin active. No authentication, user interaction, or special configuration beyond default plugin installation is required - the vulnerable user simulation/crawler hash logic is present in default installs. Network reachability to the WordPress site (typically HTTP/HTTPS over ports 80/443) is the only access prerequisite. Limiting factors are minimal: sites behind IP-restricted admin interfaces or WAFs that rate-limit or block the specific vulnerable endpoint may slow brute-force attempts, but no inherent CVSS-derived restriction (PR:N, UI:N, AC:L) gates exploitation.

Multiple intelligence signals converge to indicate critical, immediate risk. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H confirms network-reachable, low-complexity exploitation requiring no authentication or user interaction, scoring 9.8. The EPSS score of 88.85% in the 100th percentile is among the highest possible probability ratings, signaling massive observed scanning and exploitation interest. Publicly available exploit code further lowers the skill barrier. While the input does not list KEV status, the combination of mass deployment (WordPress plugin used on millions of sites), trivially exploitable unauthenticated RCE-equivalent (admin takeover), and active POC means this should be treated as high-priority regardless of formal KEV inclusion. No conflicting signals are present.

An attacker scans the internet for WordPress sites running LiteSpeed Cache and, against a discovered target, sends repeated requests with guessed security hash values targeting the user simulation feature. Because the hash space is limited to roughly one million values, brute-force guessing is feasible within hours; once a valid hash is found, the attacker impersonates an administrator user, creates a new admin account, and uploads a malicious plugin or theme to achieve full site takeover. Publicly available exploit code makes this scenario achievable by low-skill attackers.