CVE-2024-28000
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
7Exploited in Wild
-Decision
Descriptions
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1.
The LiteSpeed Cache plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.3.0.1. This is due to the plugin not properly restricting the role simulation functionality allowing a user to set their current ID to that of an administrator, if they have access to a valid hash which can be found in the debug logs or brute forced. This makes it possible for unauthenticated attackers to spoof their user ID to that of an administrator, and then create a new user account with the administrator role utilizing the /wp-json/wp/v2/users REST API endpoint. In some environments, the crawler may be disabled making this a non-exploitable issue in those instances.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-02-29 CVE Reserved
- 2024-08-21 CVE Published
- 2024-08-21 CVE Updated
- 2024-08-22 EPSS Updated
- 2024-08-23 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-266: Incorrect Privilege Assignment
- CWE-269: Improper Privilege Management
CAPEC
- CAPEC-233: Privilege Escalation
References (9)
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/180423 | 2024-08-28 | |
| https://github.com/realbotnet/CVE-2024-28000 | 2024-08-23 | |
| https://github.com/Alucard0x1/CVE-2024-28000 | 2024-08-25 | |
| https://github.com/arch1m3d/CVE-2024-28000 | 2024-08-30 | |
| https://github.com/ebrasha/CVE-2024-28000 | 2024-09-02 | |
| https://github.com/JohnDoeAnonITA/CVE-2024-28000 | 2024-09-11 | |
| https://github.com/SSSSuperX/CVE-2024-28000 | 2024-09-09 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| LiteSpeed Technologies Search vendor "LiteSpeed Technologies" | LiteSpeed Cache Search vendor "LiteSpeed Technologies" for product "LiteSpeed Cache" | >= 1.9.0.0 <= 6.3.0.1 Search vendor "LiteSpeed Technologies" for product "LiteSpeed Cache" and version " >= 1.9.0.0 <= 6.3.0.1" | en |
Affected
| ||||||