Skip to content
OpenAdvisories
Critical · 9.8 Scanner template Public exploit CVE-2024-28000 EUVD-2024-25174GHSA-3cp9-7899-h8r7

WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

Published Aug 21, 2024 · Updated Apr 29, 2026 · Assigned by Patchstack

Vendor: LiteSpeed Technologies Product: LiteSpeed Cache

Description

Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.

Affected products

VendorProductAffectedFixed
LiteSpeed Technologies LiteSpeed Cache ≤ 6.3.0.1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 6 repositories

  • Alucard0x1/CVE-2024-28000 ★ 23 · Aug 24, 2024

    LiteSpeed Cache Privilege Escalation PoC

  • arch1m3d/CVE-2024-28000 ★ 7 · Aug 27, 2024

    PoC for the CVE-2024 Litespeed Cache Privilege Escalation

  • JohnDoeAnonITA/CVE-2024-28000 ★ 5 · Sep 10, 2024

    CVE-2024-28000 Exploit for litespeed-cache =<6.3 allows Privilege Escalation with creation of administrator account

  • SSSSuperX/CVE-2024-28000 ★ 1 · Sep 9, 2024

    CVE-2024-28000 LiteSpeed Cache Privilege Escalation Scan&Exp

  • shawnng078-ops/CVE-2024-28000-Exploit-Lab ★ 0 · Aug 22, 2026

    Hands-on reproduction of CVE-2024-28000 in LiteSpeed Cache using an isolated WordPress lab. Includes reconnaissance, vulnerable hash recovery, Administrator privilege escalation proof, cleanup, and r…

  • AliHzSec/CVE-2024-28000 ★ 0 · Jul 30, 2026

    Hands-on exploit lab for CVE-2024-28000 — unauthenticated privilege escalation in LiteSpeed Cache (WordPress plugin, <=6.3.0.1). Spins up a vulnerable environment with Docker and includes a Go-based …

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References