Analysis Summary

CVE-2024-28000

LiteSpeed Technologies LiteSpeed Cache Plugin for WordPress could allow a remote attacker to gain elevated privileges on the system, caused by a weak security hash in a user simulation feature. By sending a specially crafted POST request, an attacker could exploit this vulnerability to gain Administrator level access after which malicious plugins could be uploaded and installed.

Impact

• Privilege Escalation

Indicators of Compromise

CVE

• CVE-2024-28000

Affected Vendors

Remediation

Upgrade to the latest version of LiteSpeed Cache Plugin for WordPress, available from the LiteSpeed Technologies Website.

LiteSpeed Technologies Website