A super popular WordPress plugin was found vulnerable to a crosssite scripting attack which could allow threat actors to steal sensitive information and escalate privileges on websites.
Security researchers Patchstack discovered the flaw and reported it to the developers, before publishing their findings on their blog.
As per the report, the plugin in question is called LiteSpeed Cache, it’s a website optimization plugin designed to improve website performance.
Patch available
The plugin counts more than four million active installations (The Hacker News claims five million). The vulnerability, described as “sitewide stored XSS” flaw, can be exploited by performing a single HTTP request. It is now tracked as CVE202340000.
“This vulnerability occurs because the code that handles input from the user doesn’t implement sanitization and output escaping,” the researchers explained in the blog. “This case also combined with improper access control on one of the available REST API endpoints from the plugin.”
Since the discovery, LiteSpeed Cache’s developers released a patch. Users are advised to update their plugins to at least version 5.7.0.1, and secure their websites from potential attackers. The patch became available in October last year. The latest version, 6.1, was released on February 5, The Hacker News reported.
WordPress is the world’s number one website builder, powering roughly half of the global internet. As such, it’s a popular target among hackers looking for easy ways into databases, where they can steal sensitive data, mount malicious advertising campaigns, phishing, and more. Still, WordPress is generally considered safe, unlike its many themes and plugins which are usually considered the weakest link.