CySec
en
  1. Home
  2. Blog
  3. Vulnerabilities & CVE

WordPress LiteSpeed Cache (CVE-2024-28000): any visitor could become an administrator

A weak security hash in a caching plugin used on millions of sites allowed unauthenticated privilege escalation. Update and check your admin users.

3 min read

Publicly disclosed: 21 August 2024

LiteSpeed Cache is one of the most popular WordPress plugins, installed on more than 5 million sites. Patchstack disclosed that its “user simulation” feature was protected by a weak, guessable hash, so an unauthenticated visitor could get administrator rights and then install malicious plugins.

CVESeverityAffectedFixed in
CVE-2024-28000Critical, CVSS 9.8 (privilege escalation)LiteSpeed Cache up to 6.3.0.16.4 (released 13 August 2024) and later

How to protect a WordPress site

  1. Turn on automatic updates for plugins, or check updates at least weekly — most mass attacks start within days of a fix.
  2. Remove plugins and themes you do not use; install only from the official directory or the vendor.
  3. Use a web application firewall (WAF) or a security plugin with virtual patching.
  4. Use MFA for administrators and check the user list for unknown admin accounts.
  5. Keep off-site backups of files and the database.

After updating, check Users for administrator accounts you do not recognise.

Sources: Patchstack, NVD CVE-2024-28000.

Need help with this? Contact CySec for a free consultation.

Tags:#Website security#WordPress

All articles

More on this topic

All articles in this topic
12 November 2026· 3 min read

N-able N-central “4EverAble2Shell” zero-day: when the remote management server is the target

A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.

Read article
10 November 2026· 4 min read

Outlook zero-day CVE-2026-124194 and November 2026 Patch Tuesday: what to update first

An exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.

Read article
9 November 2026· 3 min read

Chrome zero-day CVE-2026-125350: update the browser and restart it

Google fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.

Read article

Need help with this?

Our engineers can review your current setup and propose concrete improvements.

Request a quote
WhatsApp+374 33 870717 Emailinfo@cysec.am