Cybersecurity researchers have disclosed a critical security flaw in the LiteSpeed Cache plugin for WordPress that could allow unauthenticated users to gain administrator privileges.
The vulnerability, tracked as CVE-2024-28000 with a CVSS score of 9.8, has been patched in version 6.4 of the plugin released on August 13, 2024, affecting all versions prior to 6.3.0.1.
LiteSpeed Cache, with over five million active installations, is one of the most popular caching plugins in WordPress.
The flaw exploited in CVE-2024-28000 enables an unauthenticated attacker to spoof their user ID and register as an administrative-level user, granting them control over a vulnerable WordPress site.
The vulnerability lies in a user simulation feature that uses a weak security hash derived from a non-cryptographically secure random number generator, making it vulnerable to exploitation.
Wordfence highlighted the risk posed by this flaw, emphasizing the importance of users updating to the latest version to mitigate potential exploits.
It’s worth noting that the vulnerability is not exploitable on Windows-based WordPress installations due to the reliance on a PHP method not implemented on Windows.
As cyber threats continue to evolve, maintaining strong security practices and promptly addressing vulnerabilities is crucial to safeguarding websites.