The National Information Technology Development Agency (NITDA) has issued a critical security alert concerning a newly discovered vulnerability, CVE-2024-28000, affecting over 5 million websites globally.
This vulnerability impacts the LiteSpeed Cache plugin for WordPress, a popular tool used to optimize website performance, and could allow attackers to gain full control over affected websites.
According to NITDA, the vulnerability arises from a flaw in the plugin’s “role simulation” feature, which can be exploited by cybercriminals to gain administrative access to websites without the need for authentication.
Once an attacker takes control of a site, they could install malicious plugins, steal sensitive data, or redirect visitors to harmful websites.
This attack is made easier due to a combination of a weak hash function and the simplicity of the attack vector. Cyber attackers can exploit this flaw through brute-force guessing or by manipulating exposed debug logs to access administrative privileges.
NITDA noted that with over 5 million websites using the LiteSpeed Cache plugin, the potential impact of this vulnerability is significant.
According to the agency, websites at risk could experience:
Given the scale of WordPress usage, this vulnerability could have a severe effect on businesses, leading to financial losses and reputational damage.
To mitigate the risk of exploitation, NITDA urges all WordPress website administrators using the LiteSpeed Cache plugin to take immediate action by updating the LiteSpeed Cache Plugin.
“Ensure that the plugin is updated to the latest version (6.4.1). To check for updates, log in to your WordPress dashboard, navigate to the “Plugins” section, and update LiteSpeed Cache if necessary,” NITDA stated.
“Website owners should frequently check for vulnerabilities and ensure their plugins are up to date,” the agency added.
The LiteSpeed Cache plugin for WordPress is a tool that improves website performance and loading speed by caching website content and resources.