August 22, 2024 at 06:21AM
A critical security vulnerability in the Litespeed Cache plugin, affecting more than 5 million WordPress websites, allows unauthenticated attackers to gain administrator privileges. The bug bounty program of Patchstack disclosed this vulnerability, leading to a $14,400 reward for the researcher. Although a fix has been issued, around 2 million websites remain vulnerable.
Based on the meeting notes, the key takeaways are as follows:
– A critical security vulnerability (CVE-2024-28000) has been discovered in the Litespeed Cache plugin, which affects over 5 million active installations on WordPress websites.
– The vulnerability allows an unauthenticated attacker to gain administrator privileges on a targeted website, potentially leading to the deployment of malware.
– The plugin developers were made aware of the vulnerability and released a patch (version 6.4) on August 13, 2024.
– Despite the patch release, approximately two million websites may still be vulnerable, as only 30% of installations are running the patched version.
– The vulnerability can be exploited through brute-force attacks to obtain a weak security hash, which is also leaked in debugging mode logs, providing multiple avenues for exploitation.
– Both Patchstack and Defiant, WordPress security firms, have warned of the likelihood of active exploitation of this vulnerability in the near future.
These takeaways outline the severity of the vulnerability, the potential impact on vulnerable websites, and the urgent need for website owners to update their Litespeed Cache plugin to the latest patched version.