Millions of WordPress websites could be vulnerable to takeover due to a critical security hole found in the Litespeed Cache plugin.
Litespeed Cache is a free caching plugin designed to improve the performance of WordPress websites. The plugin currently has more than 5 million active installations.
Researcher John Blackbourn discovered that the plugin is affected by a critical privilege escalation vulnerability that can be exploited by an unauthenticated attacker to obtain administrator privileges on the targeted WordPress website.
The security hole, tracked as CVE-2024-28000, was responsibly disclosed through the bug bounty program of WordPress security firm Patchstack, and earned the researcher $14,400.
The plugin’s developers were notified on August 5 and issued a patch on August 13, with the release of version 6.4.
Data from WordPress.org shows roughly three million downloads of the plugin since the patch was released, which means two million websites could still be vulnerable to attacks exploiting CVE-2024-28000. On the other hand, WordPress.org data also shows that only 30% of installations are running version 6.4.
According to Patchstack, “The vulnerability exploits a user simulation feature in the plugin which is protected by a weak security hash that uses known values.”
An unauthenticated attacker who can obtain the security hash can create a new administrator-level user account, enabling them to deploy malware on the targeted site.
The security hash has only one million possible values, which makes it possible to obtain the hash through a brute-force attack that can take between a few hours and one week, based on Patchstack’s estimates. However, the hash is also leaked in logs on sites with debugging mode enabled, which creates another attack avenue.
Patchstack CEO Oliver Sild told SecurityWeek that the need to obtain the hash makes it less likely for the vulnerability to be mass-exploited and more likely to be leveraged in targeted attacks.
However, Sild noted, “Taking into account how many websites use this plugin, for a hacker who wishes to take over a specific website it’s a rather simple exploit to gain full access.”
WordPress security firm Defiant, which has also analyzed the critical vulnerability, says it has “no doubts that this vulnerability will be actively exploited very soon”.
Related: Critical Flaw in Donation Plugin Exposed 100,000 WordPress Sites to Takeover
Related: Several Plugins Compromised in WordPress Supply Chain Attack
Related: Critical WordPress Plugin Flaws Exploited to Inject Malicious Scripts and Backdoors
