Cross-Site Request Forgery Vulnerability in LiteSpeed Cache Plugin
CVE-2024-3246

5.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Litespeed Cache
Vendor
CVE Published:
24 July 2024

Badges

📰 News Worthy

Summary

The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected Version(s)

LiteSpeed Cache * <= 6.2.0.1

News Articles

favicon imageCybersecurityNews

LiteSpeed Cache Plugin Flaw Let Attackers Inject Malicious Code, 5M+ Sites Impacted

The popular LiteSpeed Cache plugin for WordPress has been found vulnerable to a CSRF attack, potentially impacting over 5 million websites.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3123399/lite...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by CybersecurityNews

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.