LiteSpeed Cache CVE-2024-28000
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
DescriptionNVD
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
AnalysisAI
Privilege escalation in LiteSpeed Cache plugin for WordPress (versions up to and including 6.3.0.1) allows unauthenticated remote attackers to forge user identities and gain administrator-level access by exploiting a weak hash check in the plugin's user simulation feature. Publicly available exploit code exists, and the EPSS score of 88.85% (100th percentile) indicates extremely high likelihood of exploitation activity. The vulnerability stems from predictable security hash values that can be brute-forced to impersonate any logged-in user, including administrators.
Technical ContextAI
LiteSpeed Cache is one of the most widely deployed WordPress performance plugins, used on millions of sites to provide page caching, image optimization, and CDN integration. The CPE identifier cpe:2.3:a:litespeedtech:litespeed_cache confirms the affected component is the WordPress plugin distributed by LiteSpeed Technologies. The root cause, classified as CWE-266 (Incorrect Privilege Assignment), lies in the plugin's crawler feature, which simulates logged-in users to generate cached pages. The simulation relies on a security hash that has a limited range of possible values (approximately one million), making it feasible to brute-force and impersonate privileged WordPress users including administrators.
RemediationAI
Vendor-released patch: upgrade LiteSpeed Cache to version 6.4 or later, which addresses the weak hash check by strengthening the security hash generation in the user simulation logic. WordPress administrators should update immediately through the WordPress plugin dashboard or by downloading the latest release from the LiteSpeed Cache plugin page on WordPress.org. If patching cannot be done immediately, compensating controls include temporarily deactivating the LiteSpeed Cache plugin (this will eliminate page caching benefits and may significantly impact site performance) or restricting access to the WordPress admin interface and plugin REST endpoints via IP allowlisting at the web server or WAF layer (this may break legitimate admin workflows from dynamic IPs). Additionally, review WordPress user lists for unexpected administrator accounts and rotate credentials for existing admin users.
Share
External POC / Exploit Code
Leaving vuln.today