LiteSpeed Cache Bug Exploit For Control Of WordPress Sites

Wajahat Raja

May 20, 2024 - TuxCare expert team

In recent developments concerning WordPress security, a significant vulnerability has come to light in the widely used LiteSpeed Cache plugin. This LiteSpeed cache bug, labeled CVE-2023-40000, poses a substantial risk to WordPress site owners, as it allows threat actors to exploit websites, gaining unauthorized access and control. Let’s delve into the details of this vulnerability, its implications, and how you can protect your WordPress site from potential exploitation.

Understanding the LiteSpeed Cache Bug

The CVE-2023-40000 vulnerability, discovered by Patchstack and disclosed in February 2024, represents a stored cross-site scripting (XSS) weakness within the LiteSpeed Cache plugin. With a severity score of 8.3, this vulnerability enables malicious actors to execute specially crafted HTTP requests, thereby elevating their privileges and gaining unauthorized access to vulnerable WordPress sites.

Hackers Target WordPress Sites

Hackers have wasted no time in exploiting this LiteSpeed cache bug, targeting WordPress sites that utilize outdated versions of the LiteSpeed Cache plugin. By leveraging CVE-2023-40000, threat actors can create malicious admin accounts, assuming control over the compromised websites. Notably, versions of the plugin older than 5.7.0.1 are susceptible to this exploit, leaving numerous sites vulnerable to exploitation.

LiteSpeed Cache, a popular caching plugin employed by over five million WordPress sites, promises to enhance page load times and improve user experience. However, the recent revelation of CVE-2023-40000 underscores the importance of timely updates and security measures. Alarmingly, WPScan has reported increased scanning activity from threat actors, with more than 1.2 million probing requests originating from a single IP address.

Identifying potential compromises on your WordPress site is crucial for timely intervention. Malicious actors inject harmful JavaScript code into critical WordPress files or the database, often manifesting as the creation of administrator users with specific names like ‘wpsupp‑user’ or ‘wp‑configuser.’ Additionally, the presence of suspicious strings, such as “eval(atob(Strings.fromCharCode,” within database options, serves as a red flag indicating a possible WordPress security breach.

Addressing the Vulnerability

The LiteSpeed team promptly addressed the LiteSpeed cache bug in version 5.7.0.1, emphasizing the importance of keeping plugins updated to mitigate security risks. With the latest release, version 6.2.0.1, users are encouraged to apply patches promptly to safeguard their WordPress installations against potential exploitation. Despite these efforts, a significant number of users, up to 1,835,000, continue to operate vulnerable versions of the plugin, underscoring the need for heightened vigilance and proactive security measures.

Mitigating WordPress Security Risks

To mitigate the risks associated with the LiteSpeed Cache exploit and similar vulnerabilities, WordPress site owners are advised to take proactive steps. Firstly, installing the latest plugin updates is paramount, as it patches known security flaws and strengthens the site’s defenses against potential exploitation. Additionally, conducting a thorough review of installed plugins and deleting any suspicious files or folders can help mitigate risks associated with unauthorized access and control.

Enhancing Security Measures

In light of emerging threats targeting WordPress sites, enhancing security measures is essential to safeguarding your online presence. WPScan recommends conducting database searches for suspicious strings, such as “eval(atob(Strings.fromCharCode,” within specific options like ‘litespeed.admin_display.messages.’ By remaining vigilant and proactive in identifying and addressing WordPress security vulnerabilities, WordPress site owners can mitigate the risks posed by malicious actors seeking to exploit known weaknesses.

Secure WordPress Website

In addition to vulnerabilities within plugins, WordPress site owners must remain vigilant against redirect scam campaigns, such as Mal.Metrica. This malicious campaign employs fake CAPTCHA verification prompts to deceive users and redirect them to fraudulent websites, where they may encounter malware or phishing attempts. Security researcher Ben Martin warns users to exercise caution when encountering unexpected prompts or suspicious links, as they may lead to potentially harmful destinations.

Conclusion

The discovery of the LiteSpeed cache bug serves as a stark reminder of the ongoing threat landscape facing WordPress site owners. By understanding the nature of the vulnerability, recognizing signs of compromise, and implementing proactive mitigation strategies, users can bolster their site’s security posture and minimize the risk of exploitation.

To enhance your website’s performance and security, it’s crucial to regularly update LiteSpeed Cache plugin. With vigilance, timely updates, and adherence to best practices, WordPress site owners can navigate the digital landscape with confidence, safeguarding their online presence against emerging threats.

The sources for this piece include articles in The Hacker News and Bleeping Computer.

Summary