CVE-2024-28000: WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
First published: Wed Aug 21 2024(Updated: )
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1.
Credit: audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| LiteSpeed Cache | >=1.9<6.3.0.1 | |
| LiteSpeed Cache | <=6.3.0.1 | |
| LiteSpeed Technologies LiteSpeed Cache | >=1.9<6.4 |
Remedy
Update to 6.4 or a higher version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites?_s_id=cve
- https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-6-3-0-1-unauthenticated-privilege-escalation-vulnerability?_s_id=cve
- https://www.bleepingcomputer.com/news/security/litespeed-cache-bug-exposes-millions-of-wordpress-sites-to-takeover-attacks/
- https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-bug-in-litespeed-cache-plugin/
- https://www.bleepingcomputer.com/news/security/litespeed-cache-bug-exposes-6-million-wordpress-sites-to-takeover-attacks/
- https://www.bleepingcomputer.com/news/security/litespeed-cache-wordpress-plugin-bug-lets-hackers-get-admin-access/
Frequently Asked Questions
What is the severity of CVE-2024-28000?
CVE-2024-28000 is a critical vulnerability that allows privilege escalation in LiteSpeed Cache.
Who is affected by CVE-2024-28000?
CVE-2024-28000 affects LiteSpeed Cache versions from 1.9 through 6.3.0.1.
How do I fix CVE-2024-28000?
To fix CVE-2024-28000, upgrade LiteSpeed Cache to the latest version beyond 6.3.0.1.
What impact does CVE-2024-28000 have on my website?
CVE-2024-28000 can potentially allow attackers to escalate their privileges and take control of affected WordPress sites.
Is there a patch available for CVE-2024-28000?
Yes, a patch has been released that addresses CVE-2024-28000, which can be applied by updating the LiteSpeed Cache plugin.
- agent/remedy
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-28000
- alias/CVE-2023-40000
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/description
- alias/CVE-2024-44000
- alias/CVE-2024-50550
- agent/references
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/litespeed technologies
- canonical/litespeed cache
- vendor/litespeedtech
- canonical/litespeed technologies litespeed cache
- version/litespeed technologies litespeed cache/1.9