The LiteSpeed Cache Plugin Vulnerability: A Threat to Millions of WordPress Sites

A critical vulnerability in the LiteSpeed Cache plugin has been identified, potentially exposing millions of WordPress sites to severe security risks. This flaw, discovered by John Blackbourn through the Patchstack zero-day bug bounty program, allows unauthorized users to gain administrator-level access, leading to the installation of malicious plugins and compromise of affected websites.

The vulnerability stems from the plugin’s weak security hash used in its user simulation feature. The hash is created through an insecure random number generator and stored without being salted or tied to a specific user request. With only one million possible values, attackers can easily guess the hash, granting them access as an administrator user.

According to Patchstack, a brute force attack running at a relatively low three requests per second can gain access to the site within a few hours to a week. Even if the plugin’s crawler feature is disabled, attackers can trigger the weak security hash generation via an unprotected Ajax handler, putting sites at risk regardless of their settings.

The importance of strong and unpredictable security measures for hashes or nonces is emphasized by Patchstack. LiteSpeed has released a patch to address the vulnerability, enhancing hash complexity, implementing one-time-use hashes, and introducing stricter validation procedures.

Recommended Actions For Users

Users of the LiteSpeed Cache plugin are urged to update to version 6.4 immediately to safeguard their sites against this security risk. The patch includes measures like using the hash_equals function for comparison, employing a more secure random value generator, and enhancing overall security protocols.

Protect your WordPress site and prevent unauthorized access by taking proactive steps to secure your plugins and stay informed about potential vulnerabilities. Stay one step ahead of attackers to ensure your website remains safe and secure.

Stay updated on WordPress plugin vulnerabilities and keep your site protected from potential threats.