CVE-2024-28000: LiteSpeed Cache unauthenticated privilege escalation via weak hash

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with unauthenticated remote privilege escalation to administrator and high EPSS score makes this an urgent threat.

What it is

LiteSpeed Cache for WordPress, up to version 6.3.0.1, assigns privileges incorrectly (CWE-266), allowing an unauthenticated attacker to escalate to administrator. The flaw is remotely reachable with no authentication or user interaction, making it a critical risk for any site running the affected plugin.

Impact

An attacker can gain full administrative control of the WordPress site, leading to complete compromise of confidentiality, integrity, and availability. This enables arbitrary plugin/theme installation, data theft, and persistent backdoors.

Attack surface

The vulnerability is reachable over the network via HTTP requests to the WordPress site; no authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Exploitation is likely: EPSS is 0.68266 (99.3rd percentile) and a public Exploit-DB entry exists, though the CVE is not listed in CISA KEV.

What to do

• Update LiteSpeed Cache to a version later than 6.3.0.1 immediately.
• If patching is not possible, disable or remove the LiteSpeed Cache plugin until an update can be applied.
• Enforce strong, unique WordPress administrator credentials and enable multi-factor authentication for all admin accounts.
• Monitor for unexpected administrator account creation or privilege changes and revert them promptly.
• Apply virtual patching or a web application firewall rule to block exploit attempts if available.

Detection

• Audit WordPress user roles and capabilities for unexpected administrator accounts or privilege escalations.
• Review web server and WordPress logs for suspicious requests targeting LiteSpeed Cache endpoints, especially those attempting to set user roles.
• Monitor for unauthorized plugin/theme installations or file modifications that may indicate post-exploitation activity.
• Use file integrity monitoring to detect changes to WordPress core, plugins, and themes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.