Severity
High
Analysis Summary
CVE-2024-28000
LiteSpeed Technologies LiteSpeed Cache Plugin for WordPress could allow a remote attacker to gain elevated privileges on the system, caused by a weak security hash in a user simulation feature. By sending a specially crafted POST request, an attacker could exploit this vulnerability to gain Administrator level access after which malicious plugins could be uploaded and installed.
Impact
- Privilege Escalation
Indicators of Compromise
CVE
- CVE-2024-28000
Affected Vendors
WordPress
Affected Products
- LiteSpeed Technologies LiteSpeed Cache for WP
Remediation
Upgrade to the latest version of LiteSpeed Cache Plugin for WordPress, available from the LiteSpeed Technologies Website.