Another top WordPress plugin has a major security flaw and millions of sites could be affected

Date:
Thu, 22 Aug 2024 13:03:00 +0000

Description:
LiteSpeed Cache flaw allowed threat actors to install additional plugins, essentially taking over the site.

FULL STORY ======================================================================

LiteSpeed Cache (free version), arguably the worlds most popular WordPress plugin for site optimization, was vulnerable in a way that allowed hackers to obtain admin-level privileges and essentially take over the websites that had it installed.

This is according to the WordPress vulnerability mitigation project, Patchstack , whose member, John Blackbourn, discovered and reported the flaw.

As per the WordPress Plugins page, LiteSpeed Cache has more than five million active installations at press time, meaning the potential attack surface
could be quite extensive. Big bounty

LiteSpeed Cache is a plugin for the WordPress website builder designed to
help optimize websites for speed. It features an exclusive server-side cache, as well as a wide variety of optimization features. WordPress Multisite is supported, and the plugin is compatible with the majority of other popular solutions, such as Yoast SEO, or WooCommerce. Its generally designed for WordPress sites that use the LiteSpeed Web Server, but it works with Apache, and Nginx, too

The vulnerability was found in the plugins user simulation feature, which was protected by a weak security hash that uses known values, the researcher explained. A hacker would be able to brute force all one million known possible values for the security hash and pass them in the litespeed_hash cookie in mere hours, it was said. The only prerequisite was knowing the admins ID, which is just 1 in many cases.

The vulnerability is now tracked as CVE-2024-28000. Web admins running this plugin on their website are advised to update it to the latest version (6.4) immediately, since this version mitigates the problem. Failing to do so could result in complete website takeover, since the flaw allows attackers to install other plugins, at will.

The researcher who found the bug, John Blackbourn, was awarded $14,400 in
cash for his work, the highest bounty in the history of WordPress bug bounty hunting, Patchstack concluded. More from TechRadar Pro Thousands of WordPress sites potentially at risk from plugin security flaw Here's a list of the best firewall software around today These are the best endpoint security tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/another-top-wordpress-plugin-has-a-majo r-security-flaw-millions-of-sites-could-be-affected


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)