Severe Vulnerability in WordPress LiteSpeed Cache Plugin Puts Sites at Risk of Admin Takeover

A newly discovered vulnerability in the LiteSpeed Cache plugin for WordPress is causing significant concern in the cybersecurity community. The flaw, identified by researchers, could allow unauthorized users to gain administrative access to WordPress sites, potentially leading to severe security breaches. This alarming vulnerability highlights the growing need for website administrators to be vigilant and proactive in securing their digital assets.

The Nature of the Vulnerability

The vulnerability, which has been assigned the identifier CVE-2024-28000 and a critical severity score of 9.8 on the CVSS scale, was disclosed by cybersecurity expert Rafie Muhammad from Patchstack. According to Muhammad, the flaw stems from an unauthenticated privilege escalation issue in the LiteSpeed Cache plugin, a widely used tool with over five million active installations.

This vulnerability enables an attacker, who doesn’t need to be logged in or authenticated, to escalate their privileges to that of an administrator. Once they gain these privileges, the attacker can upload and install malicious plugins, effectively taking over the WordPress site. This kind of access could lead to various forms of exploitation, including data theft, site defacement, and the spread of malware.

Technical Details of the Exploit

The root cause of CVE-2024-28000 lies in a user simulation feature within the LiteSpeed Cache plugin. The feature utilizes a security hash generated from a random number, which is supposed to ensure that only authorized users can simulate different user roles, including that of an administrator. However, the hash’s generation process is fundamentally flawed.

The random number generator used in the hash calculation is based on the microsecond portion of the current time. Because there are only a million possible values, it becomes feasible for an attacker to guess the correct hash through brute force methods. Moreover, the hash is not cryptographically secure, nor is it tied to a specific request or user, making it even more vulnerable.

Wordfence, a leading WordPress security firm, emphasized the ease with which attackers can exploit this flaw. In their alert, they noted that if an attacker can access a valid hash—either through debug logs or brute force—they could set their user ID to that of an administrator. Once this ID is spoofed, the attacker can use the WordPress REST API endpoint (/wp-json/wp/v2/users) to create a new user account with full administrative privileges.

Scope and Impact

Given that LiteSpeed Cache is one of the most popular caching plugins on the WordPress platform, the potential impact of this vulnerability is vast. Any site running a vulnerable version of the plugin is at risk, and with over five million active installations, the number of potentially compromised sites is staggering.

However, it’s important to note that this vulnerability does not affect all WordPress installations. Specifically, sites hosted on Windows servers are immune to this exploit due to a technical limitation. The hash generation function relies on the PHP method sys_getloadavg(), which is not implemented on Windows systems. As a result, the vulnerability cannot be exploited on WordPress sites running on Windows.