Summary:
A major vulnerability, CVE-2024-28000, was found in the popular WordPress plugin LiteSpeed Cache. This security flaw allows users to gain higher privileges than intended, leading to possible full site takeover. In this post, we break down how the bug happens, show a simple code snippet that demonstrates the risk, and point you to original references for more reading.

What is LiteSpeed Cache?

LiteSpeed Cache is a widely used performance plugin for WordPress, developed by LiteSpeed Technologies. It speeds up websites by caching pages and optimizing content. Over 4 million sites use this plugin, making any security issue very critical.

About the Vulnerability

- CVE: 2024-28000 (NVD entry)

Affected Versions: 1.9 up to and including 6.3..1

- Type: Incorrect Privilege Assignment / Privilege Escalation

The Problem

LiteSpeed Cache did not properly check user permissions when allowing certain actions. This means users with low privileges (like subscribers) could perform actions meant only for admins.

How Does the Exploit Work?

When a plugin doesn't correctly check a user's rights, it might assign the wrong privileges and let users perform forbidden actions.

In LiteSpeed Cache's case:
A non-admin WordPress user could trigger certain plugin features, like changing cache settings or running cache purges, which should only be done by an administrator. But due to improper permission checks, any logged-in user could send requests to these endpoints.

Below is a *simplified* code snippet representing how the check might be missing or misused

// Bad permission check in the plugin (simplified)
add_action('wp_ajax_litespeed_purge', 'litespeed_purge_func');

function litespeed_purge_func() {
    // Only check if user is logged in, but NOT their role
    if ( is_user_logged_in() ) {
        // Dangerous operation allowed for all users!
        litespeed_purge_all_cache();
        echo 'Cache purged';
    } else {
        wp_die('No permission');
    }
}

What's wrong?
This only checks if the user is logged in, not if they are an administrator (or have the proper capability). A malicious subscriber or editor could call this AJAX endpoint and trigger admin-level actions.

How it should look

function litespeed_purge_func() {
    // Secure check: Only admins allowed
    if ( current_user_can('manage_options') ) {
        litespeed_purge_all_cache();
        echo 'Cache purged';
    } else {
        wp_die('No permission');
    }
}

An attacker signs up as a regular (subscriber) user, logs in, and then sends a request like this

POST /wp-admin/admin-ajax.php?action=litespeed_purge
Cookie: wordpress_logged_in_...

If the server runs LiteSpeed Cache v6.3..1 or lower, the server executes the purge, proving that permissions are broken!

Real-World Impact

- Attackers could disable caching, change site performance settings, or even escalate privileges further with other chained bugs.

Sites become open to sabotage, persistent malicious changes, or service disruption.

Who should care?
Any WordPress site running LiteSpeed Cache plugin version 1.9–6.3..1!

Fixes & Updates

LiteSpeed Technologies released a patched version (6.3.1) with proper permission checks.
What you must do:

References

- Official NVD Entry for CVE-2024-28000
- LiteSpeed Cache WordPress Plugin Page
- Patch Release Notes – LiteSpeed Cache 6.3.1
- Wordfence Advisory (if available)

Timeline

Published on: 08/21/2024 14:15:08 UTC
Last modified on: 08/21/2024 16:06:23 UTC