A couple of interesting details about Unauthenticated Elevation of Privilege – WordPress LiteSpeed Cache Plugin (CVE-2024-28000).
🔹 The vulnerability was found by researcher John Blackbourn. He submitted it through the bug bounty program and received $14,400. 👏
🔹 The vulnerability cannot be exploited on Windows installations, because the function that is needed to generate the hash does not work on Windows. This is what researchers write in the write-up. However, they do not write how this plugin works on Windows installations and whether it works at all. 🤔 But if the plugin works and the vulnerability cannot be exploited, then it turns out that sometimes it is not such a strange idea to use Windows instead of Linux as a hosting OS for websites. 🙃
Hi! My name is Alexander and I am a Vulnerability Management specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.
А всех русскоязычных я приглашаю в ещё один телеграмм канал @avleonovrus, первым делом теперь пишу туда.