Incorrect Privilege Assignment Vulnerability in LiteSpeed Cache Allows Privilege Escalation

CVE-2024-50550

What is CVE-2024-50550?

A critical vulnerability has been discovered in the LiteSpeed Cache WordPress plugin, which was exploited to allow unauthenticated visitors to gain admin rights on affected sites. The flaw is caused by a weak hash check in the plugin's "role simulation" feature, enabling attackers to predict and brute force the hash values. Once exploited, attackers can simulate an administrator role, giving them the ability to upload malware, access databases, and edit web pages. Additionally, LiteSpeed Technologies has faced multiple security flaws in their plugin this year, some of which have been used in actual attacks to compromise websites. A fix for CVE-2024-50550 has been released in version 6.5.2 of the plugin, but a large number of sites are still exposed to this vulnerability.

News Articles

BleepingComputer

CVE-2024-50550

LiteSpeed Cache WordPress plugin bug lets hackers get admin access

The free version of the popular WordPress plugin LiteSpeed Cache has fixed a dangerous privilege elevation flaw on its latest release that could allow unauthenticated site visitors to gain admin rights.

References