Another top WordPress plugin has a major security flaw — and millions of sites could be affected

News
By
published

Flaw allowed threat actors to install additional malicious WordPress plugins

Security
(Image credit: Pixabay)

LiteSpeed Cache (free version), arguably the world’s most popular WordPress plugin for site optimization, was vulnerable in a way that allowed hackers to obtain admin-level privileges and essentially take over the websites that had it installed.

This is according to the WordPress vulnerability mitigation project, Patchstack, whose member, John Blackbourn, discovered and reported the flaw.

As per the WordPress Plugins page, LiteSpeed Cache has more than five million active installations at press time, meaning the potential attack surface could be quite extensive.

Big bounty

LiteSpeed Cache is a plugin for the WordPress website builder designed to help optimize websites for speed. It features an exclusive server-side cache, as well as a wide variety of optimization features. WordPress Multisite is supported, and the plugin is compatible with the majority of other popular solutions, such as Yoast SEO, or WooCommerce. It’s generally designed for WordPress sites that use the LiteSpeed Web Server, but it works with Apache, and Nginx, too

The vulnerability was found in the plugin’s user simulation feature, which was protected by a weak security hash that uses known values, the researcher explained. A hacker would be able to brute force all one million known possible values for the security hash and pass them in the litespeed_hash cookie in mere hours, it was said. The only prerequisite was knowing the admin’s ID, which is just “1” in many cases.

The vulnerability is now tracked as CVE-2024-28000. Web admins running this plugin on their website are advised to update it to the latest version (6.4) immediately, since this version mitigates the problem. Failing to do so could result in complete website takeover, since the flaw allows attackers to install other plugins, at will.

The researcher who found the bug, John Blackbourn, was awarded $14,400 in cash for his work, the highest bounty in the history of WordPress bug bounty hunting, Patchstack concluded.

More from TechRadar Pro

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.