UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2024-3246

LiteSpeed Cache: Cross-Site Request Forgery (CSRF)

Severity
Medium 5.4
Published
23 Jul 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
6.3
Also known as
WPV-713e4660828d
Sources
NVD, WPVulnerability

Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.0.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the token setting and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as…

Affected software

SoftwareAffected versions
LiteSpeed CacheServers and applications · cpe:a:litespeedtech:litespeed_cache
  • Every version before 6.3
LiteSpeed CacheWordPress plugins · wp-plugin:litespeed-cache
  • Every version before 6.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-3246
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-3246
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-6201-cross-site-request-forgery-to-stored-cross-site-scripting