Incorrect Privilege Assignment vulnerability in LiteSpeed Cache allows Privilege Escalation

CVE-2024-28000

Summary

The CVE-2024-28000 vulnerability is found in the widely-used LiteSpeed Cache Plugin for WordPress websites, allowing unauthenticated users to gain administrator-level access and create new user accounts with the administrator role. This critical privilege escalation vulnerability has a high CVSS score of 9.8 and has been patched in version 6.4 of the plugin. It is advised to update the plugin immediately to protect against potential exploitation. The vulnerability stems from the plugin’s user simulation feature and poses a significant risk to the security of WordPress websites. Although it has not been exploited by ransomware groups, researchers have warned that active exploitation is likely to occur soon.

News Articles

WP Tavern

CVE-2024-28000

Record Bounty Awarded as Critical Privilege Escalation Vulnerability Patched in LiteSpeed Cache Plugin

The LiteSpeed Cache Plugin, widely used to enhance the speed and performance of WordPress websites, recently patched a critical unauthenticated privilege escalation vulnerability (CVE-2024-28000). …

5 months ago

References