LiteSpeed Cache is a widely used WordPress plugin, with over 6 million users, designed to improve website performance through page caching and content optimization. It is highly regarded by WordPress site owners for its speed-enhancing features and compatibility with other essential plugins, such as WooCommerce and Yoast SEO. However, a recent vulnerability has highlighted the risks associated with using outdated versions of the plugin, which can compromise website security.
| Product | litespeed-cache |
| Date | 2024-11-01 09:24:52 |
| Information |
|
Technical Summary
The LiteSpeed Cache plugin contained a privilege escalation vulnerability that allowed attackers to gain administrator-level access to a website without the need for login credentials. This access allowed attackers to install malicious plugins or make unauthorized changes. The vulnerability stemmed from the use of a weak security hash in the plugin’s role simulation feature, which could be bypassed under certain crawler setting configurations. The LiteSpeed team addressed the issue in version 6.5.2 by removing the weak hash and making changes to other security checks. Users are advised to update to the patched version to protect their sites from unauthorized access.
Recommendations
Update immediately: – If your site uses LiteSpeed Cache, update to version 6.5.2 or later to ensure site security.
Protect your organisation with Threat Intelligence and Digital Risk Protection.
Choose ISGroup for a practical, tailored engagement:
- A focused assessment of your environment and requirements
- Clear findings with a prioritised, actionable roadmap
- Direct support from experienced specialists through remediation and implementation