A super popular WordPress plugin was found vulnerable to a cross-site scripting attack which could allow threat actors to steal sensitive information and escalate privileges on websites.
Security researchers Patchstack discovered the flaw and reported it to the developers, before publishing their findings on their blog.
As per the report, the plugin in question is called LiteSpeed Cache, it’s a website optimization plugin designed to improve website performance.
Patch available
The plugin counts more than four million active installations (The Hacker News claims five million). The vulnerability, described as “site-wide stored XSS” flaw, can be exploited by performing a single HTTP request. It is now tracked as CVE-2023-40000.
“This vulnerability occurs because the code that handles input from the user doesn’t implement sanitization and output escaping,” the researchers explained in the blog. “This case also combined with improper access control on one of the available REST API endpoints from the plugin.”
Since the discovery, LiteSpeed Cache’s developers released a patch. Users are advised to update their plugins to at least version – 5.7.0.1, and secure their websites from potential attackers. The patch became available in October last year. The latest version, 6.1, was released on February 5, The Hacker News reported.
WordPress is the world’s number one website builder, powering roughly half of the global internet. As such, it’s a popular target among hackers looking for easy ways into databases, where they can steal sensitive data, mount malicious advertising campaigns, phishing, and more. Still, WordPress is generally considered safe, unlike its many themes and plug-ins which are usually considered the weakest link.
Plugins, especially non-commercial ones, are often developed by small teams (or individuals), sometimes abandoned, and usually not maintained efficiently. That makes them the ideal entry point for attacks, which is why Patchstack, Wordfence, and other WordPress-oriented security firms, often report on finding and eliminating bugs in plugins and themes, and not WordPress itself.
