CVE-2024-28000

🗓️ 21 Aug 2024 13:53:57Reported by PatchstackType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 232 Views🌐 WEB

Incorrect Privilege Assignment vulnerability in LiteSpeed Cach

Reporter	Title	Published	Views	Family All 28
GithubExploit	Exploit for Incorrect Privilege Assignment in Litespeedtech Litespeed_Cache	25 Aug 202416:57	–	githubexploit
GithubExploit	Exploit for Incorrect Privilege Assignment in Litespeedtech Litespeed_Cache	27 Aug 202407:20	–	githubexploit
GithubExploit	Exploit for Incorrect Privilege Assignment in Litespeedtech Litespeed_Cache	10 Sep 202408:16	–	githubexploit
GithubExploit	Exploit for Incorrect Privilege Assignment in Litespeedtech Litespeed_Cache	24 Aug 202405:12	–	githubexploit
GithubExploit	Exploit for Incorrect Privilege Assignment in Litespeedtech Litespeed_Cache	9 Sep 202406:19	–	githubexploit
BDU FSTEC	The vulnerability of the LiteSpeed Cache plugin for WordPress (LSCWP), a content management system for WordPress websites, relates to improper privilege assignment, allowing attackers to escalate their privileges.	16 Sep 202400:00	–	bdu_fstec
Circl	CVE-2024-28000	21 Aug 202416:34	–	circl
CNNVD	WordPress Plugin LiteSpeed Cache 安全漏洞	21 Aug 202400:00	–	cnnvd
Cvelist	CVE-2024-28000 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability	21 Aug 202413:53	–	cvelist
Exploit DB	Litespeed Cache WordPress Plugin 6.3.0.1 - Privilege Escalation	15 Jun 202500:00	–	exploitdb

NVD

Vulners

Vulnrichment

Node

litespeedtech litespeed_cacheRange1.9–6.4wordpress

[
  {
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected",
    "packageName": "litespeed-cache",
    "product": "LiteSpeed Cache",
    "vendor": "LiteSpeed Technologies",
    "versions": [
      {
        "changes": [
          {
            "at": "6.4",
            "status": "unaffected"
          }
        ],
        "lessThanOrEqual": "6.3.0.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
patchstack	www.patchstack.com/database/Wordpress/Plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-6-3-0-1-unauthenticated-privilege-escalation-vulnerability
packetstorm	www.packetstorm.news/files/id/200819/
thehackernews	www.thehackernews.com/2024/08/critical-flaw-in-wordpress-litespeed.html
exploit-db	www.exploit-db.com/exploits/52328

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Brute-force-triggered hash generation endpoint used to escalate privileges.	CWE-266
litespeed_type	request body	wp-admin/admin-ajax.php	Brute-force-triggered hash generation endpoint used to escalate privileges.	CWE-266
username	request body	wp-json/wp/v2/users	Endpoint to create a new administrator user after obtaining/validating a usable hash.	CWE-266
password	request body	wp-json/wp/v2/users	Endpoint to create a new administrator user after obtaining/validating a usable hash.	CWE-266
email	request body	wp-json/wp/v2/users	Endpoint to create a new administrator user after obtaining/validating a usable hash.	CWE-266
roles	request body	wp-json/wp/v2/users	Endpoint to create a new administrator user after obtaining/validating a usable hash.	CWE-266

17 Jun 2026 07:20Current

6Medium risk

Vulners AI Score6

CVSS 3.19.8

EPSS0.67925

SSVC

CWE-266