A newly discovered vulnerability in the popular LiteSpeed Cache WordPress plugin, installed on over 6 million websites, has left these sites open to a severe cross-site scripting (XSS) attack. This flaw, identified as CVE-2024-47374, allows attackers to execute a single HTTP request to escalate privileges on a WordPress site and potentially install malicious code. The vulnerability was first reported by a security researcher known as “TaiYou” on September 24, 2024, and affects LiteSpeed Cache versions up to 6.5.0.2. Site administrators are urged to update to version 6.5.1 immediately to protect against this risk.
What is LiteSpeed Cache?
LiteSpeed Cache is widely recognized as one of the most popular caching plugins for WordPress. It boasts powerful site acceleration capabilities, a server-level cache, and a suite of optimization features that enhance site performance. This plugin supports WordPress Multisite and is compatible with key plugins like WooCommerce, bbPress, and Yoast SEO.
However, its widespread usage also makes it an attractive target for cybercriminals, especially when vulnerabilities like this one arise.
The Vulnerability: CVE-2024-47374
The most dangerous of the three flaws found by TaiYou is the unauthenticated stored XSS vulnerability, which allows attackers to insert malicious code onto the site by injecting it into a webpage that administrators view. This vulnerability does not require authentication, meaning any attacker can exploit it with minimal effort, as long as they can make a single HTTP request.
The flaw lies in the way LiteSpeed Cache handles user input, specifically in the feature that manages URL queues for generating unique CSS. It doesn’t sanitize or escape certain inputs, allowing a malicious user to inject harmful scripts. This opens up the potential for attackers to steal sensitive information, escalate privileges, and even deliver harmful payloads like redirects or malicious advertisements.
Patch and Mitigation Steps
Upon receiving notification of the vulnerability, LiteSpeed developers quickly responded with a patch. The vulnerability has been resolved in LiteSpeed Cache version 6.5.1, and users are strongly encouraged to update to this version as soon as possible.
Patchstack, the platform that received the initial vulnerability report, also provided recommendations for developers to mitigate the risks. These include applying sanitization and escaping functions to any data that is displayed on admin pages, using esc_html for outputting text in an HTML context, and sanitize_text_field to clean up user input. Developers should also ensure proper permissions are applied to endpoints to avoid unauthorized access.
Why WordPress Plugins are a Target
WordPress powers a vast number of websites globally, making it an attractive target for cyberattacks. Plugins, particularly those with large user bases like LiteSpeed Cache, are often the weak links that attackers exploit. By targeting these vulnerabilities, attackers can potentially gain control over millions of websites in a single stroke, amplifying the damage.
In this case, the vulnerability’s ease of exploitation—requiring only a single HTTP request—makes it especially dangerous, highlighting the importance of regular plugin updates and security awareness.
Conclusion
With over 6 million WordPress sites at risk due to the LiteSpeed Cache vulnerability, immediate action is required. Website administrators should update to version 6.5.1 without delay and follow security best practices to minimize the risk of future attacks. The quick response from LiteSpeed developers is encouraging, but this incident serves as a reminder that the vast WordPress ecosystem is a prime target for cybercriminals, and vigilance is key.
Stay safe online!
Source: [DarkReading]
