CVE-2024-28000

This is a security flaw in a WordPress caching plugin. Normally, only logged-in admins should be able to change powerful site settings, but this bug can let an attacker bypass that and act like an administrator. It’s like leaving a back door unlocked in a shop where an attacker can then reprogram the cash register and alarm system.

This matters if you run a WordPress website with LiteSpeed Cache for WordPress (LSCWP) (litespeed cache) installed and your version is 6.3.0.1 or older. Because the flaw can be triggered remotely without any login or user action, it’s a risk on publicly reachable sites. If the plugin is installed and reachable in your default setup, you should treat it as exposed.

This is RED because the weakness is reachable over the network without authentication and can grant full administrative control, and a public exploit is available. Attackers associated with a sustained incident pattern have been reported, which makes it the kind of bug that gets used in real attacks.

Confirm exposure

1. Log into WordPress as an administrator.
2. Go to Plugins and locate “LiteSpeed Cache for WordPress (LSCWP)” (sometimes displayed as “litespeed cache”).
3. Check the plugin version. Confirm whether it is 6.3.0.1 or earlier.
4. If you cannot access the admin UI, check your plugin directory or hosting control panel for the installed plugin version.

Patch / fix

1. Upgrade the plugin to LiteSpeed Cache for WordPress fixed in 6.4.
2. If you have multiple environments (production/staging), patch production first if you’re currently exposed; otherwise patch staging first to validate compatibility.
3. After upgrade, re-check the plugin version to confirm it is 6.4 or newer.

Verify you’re not already compromised

1. Check for unexpected changes in WordPress admin users (new admin accounts, changed roles).
2. Review recent changes to LiteSpeed Cache settings and any core WordPress settings your team didn’t make.
3. If you find signs of compromise, reset WordPress admin passwords and any reused passwords across related services; invalidate active sessions if your hosting supports it.

Temporary workaround (if you can’t patch immediately)

1. Disable the LiteSpeed Cache plugin until you can upgrade.
2. Ensure the site remains functional and that caching behavior is acceptable without the plugin.

What to monitor after patching

1. WordPress admin/login activity and new user creation.
2. Unexpected changes to plugin/theme files and settings.
3. Any repeated requests to WordPress endpoints shortly after patching (hosting logs/web server logs).

What’s happening

• Vulnerability type: CWE-266 (incorrect permission assignment) leading to unauthenticated privilege escalation.
• Mechanism: The plugin assigns permissions incorrectly, so a remote attacker can trigger functionality that results in high-level (administrative) control of the WordPress site.

Attack characteristics

• Access needed: No authentication and no user interaction.
• Prerequisite: A running WordPress site with LiteSpeed Cache for WordPress (LSCWP) version <= 6.3.0.1 installed.
• Reachability: Marked as reachable in default configuration.

Exploitation status

• Public exploit: A public exploit is available (noted as 1 known).
• KEV: Not listed in CISA KEV.
• Press reporting: No clear dated claim found in the provided news finding.

Likelihood signals

• A prediction model indicates high likelihood, but public exploitation and incident reporting are the primary drivers for urgency; EPSS details are not used as a justification in the owner-facing urgency statement.

Severity

• The impact described in the findings includes full administrative control: viewing all data, modifying settings, and disrupting operations.