CVE-2024-3246: LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3246?
CVE-2024-3246 is classified as a medium severity vulnerability due to its potential for unauthorized changes by unauthenticated attackers.
How do I fix CVE-2024-3246?
To fix CVE-2024-3246, update the LiteSpeed Cache plugin to version 6.3 or later where the vulnerability has been addressed.
Who is affected by CVE-2024-3246?
Any WordPress site using the LiteSpeed Cache plugin version 6.2.0.1 or earlier is affected by CVE-2024-3246.
What type of vulnerability is CVE-2024-3246?
CVE-2024-3246 is identified as a Cross-Site Request Forgery (CSRF) vulnerability due to improper nonce validation.
When was CVE-2024-3246 disclosed?
CVE-2024-3246 was disclosed in 2024, affecting all versions of the LiteSpeed Cache plugin up to and including 6.2.0.1.