Another top WordPress plugin has a major security flaw — and millions of sites could be affected

Flaw allowed threat actors to install additional malicious WordPress plugins

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

LiteSpeed Cache (free version), arguably the world’s most popularWordPress pluginfor site optimization, was vulnerable in a way that allowed hackers to obtain admin-level privileges and essentially take over the websites that had it installed.

This is according to the WordPress vulnerability mitigation project,Patchstack, whose member, John Blackbourn, discovered and reported the flaw.

As per the WordPress Plugins page, LiteSpeed Cache has more than five million active installations at press time, meaning the potential attack surface could be quite extensive.

Big bounty

LiteSpeed Cache is a plugin for the WordPresswebsite builderdesigned to help optimize websites for speed. It features an exclusive server-side cache, as well as a wide variety of optimization features. WordPress Multisite is supported, and the plugin is compatible with the majority of other popular solutions, such as YoastSEO, or WooCommerce. It’s generally designed for WordPress sites that use the LiteSpeed Web Server, but it works with Apache, and Nginx, too

The vulnerability was found in the plugin’s user simulation feature, which was protected by a weak security hash that uses known values, the researcher explained. A hacker would be able to brute force all one million known possible values for the security hash and pass them in the litespeed_hash cookie in mere hours, it was said. The only prerequisite was knowing the admin’s ID, which is just “1” in many cases.

The vulnerability is now tracked as CVE-2024-28000. Web admins running this plugin on their website are advised to update it to the latest version (6.4) immediately, since this version mitigates the problem. Failing to do so could result in complete website takeover, since the flaw allows attackers to install other plugins, at will.

The researcher who found the bug, John Blackbourn, was awarded $14,400 in cash for his work, the highest bounty in the history of WordPress bug bounty hunting, Patchstack concluded.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Dangerous Android banking malware looks to trick victims with fake money transfers

Sophos Firewall hack on government network used an all-new custom malware

Windows PCs targeted by new malware hitting a vulnerable driver