Hackers are exploiting a flaw in an outdated version of the LiteSpeed Cache plugin to target WordPress websites. They create administrator users and gain control of the sites, posing a significant threat to website security.
The LiteSpeed Cache (LS Cache) plugin is used in over five million WordPress sites. It's designed to speed up page loads, enhance visitor experience, and boost Google Search ranking. However, versions older than 5.7.0.1 are vulnerable to a high-severity (8.8) unauthenticated cross-site scripting flaw, known as CVE-2023-40000.
Automattic's security team, WPScan, noted increased activity from threat actors scanning for and compromising WordPress sites with these outdated versions of the plugin. One IP address alone made more than 1.2 million probing requests when scanning for vulnerable sites.
According to WPScan, the attacks involve malicious JavaScript code injected into critical WordPress files or the database. This creates administrator users named 'wpsupp‑user' or 'wp‑configuser.' Another sign of infection is the presence of the "eval(atob(Strings.fromCharCode" string in the "litespeed.admin_display.messages" option in the database.
While a large portion of LiteSpeed Cache users have migrated to more recent versions not impacted by CVE-2023-40000, up to 1,835,000 are still running a vulnerable release.
Another campaign reported by Wallarm targets a WordPress plugin named "Email Subscribers" to create administrator accounts. The hackers leverage CVE-2024-2876, a critical SQL injection vulnerability that affects plugin versions 5.7.14 and older.
Creating admin accounts on WordPress sites gives attackers full control, allowing them to modify content, install plugins, change critical settings, redirect traffic to unsafe sites, distribute malware, phishing, or steal available user data.
WordPress site admins are urged to update plugins to the latest version, remove or disable unnecessary components, and monitor for new admin accounts being created. In the event of a confirmed breach, a full site cleanup is mandatory, including deleting all rogue accounts, resetting passwords for all existing accounts, and restoring the database and site files from clean backups.
