ClosedPatched

LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)

LiteSpeed Cache (WordPress plugin)

A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.

Why this severity: CVSS 9.8 (CNA)

Started: Aug 13, 2024
Closed: Aug 21, 2024
CVE: CVE-2024-28000

WordPress
PHP
#Litespeed
#Privilege escalation

Follow this incident

RSS
JSON
llms.txt

Updated Aug 21, 2024

Affected

< 6.4 (Patchstack)

Fixed in

Timeline2

Aug 21, 2024
Patchstack publishes details
Source
Aug 13, 2024
LiteSpeed Cache 6.4 released with the fix
Source

Advisories1

NVD: CVE-2024-28000NVD · Aug 21, 2024

News & write-ups1

Critical privilege escalation in LiteSpeed Cache plugin affecting 5+ million sitesPatchstack · Aug 21, 2024 · Write-up

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Get notified