CVE-2024-28000: WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 68.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-08-21 · updated 2026-06-17
Weakness: CWE-266

Description

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.

Affected products

LiteSpeed Technologies LiteSpeed Cache: from 1.9 before 6.4 — fixed in 6.4

How to fix

Upgrade to a fixed version: LiteSpeed Technologies LiteSpeed Cache 6.4. Check the vendor advisory for mitigations.

References

https://patchstack.com/database/Wordpress/Plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-6-3-0-1-unauthenticated-privilege-escalation-vulnerability?_s_id=cve
https://packetstorm.news/files/id/200819/
https://thehackernews.com/2024/08/critical-flaw-in-wordpress-litespeed.html?m=1
https://www.exploit-db.com/exploits/52328

Get alerted when CVE-2024-28000 or the next vulnerability affects your stack