https://pwn.watch/t/litespeed Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 21 Aug 2024 00:00:00 GMT https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000 https://pwn.watch/i/litespeed-cache-privilege-escalation-cve-2024-28000 Wed, 21 Aug 2024 00:00:00 GMT critical <p>A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 6.4</p> <p><strong>Latest updates:</strong></p><ul><li>2024-08-21: Patchstack publishes details (<a href="https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites/">source</a>)</li><li>2024-08-13: LiteSpeed Cache 6.4 released with the fix (<a href="https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites/">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-28000</p>