CVE-2024-28000 PoC — WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability

Source

https://github.com/realbotnet/CVE-2024-28000

Associated Vulnerability

Title: WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability (CVE-2024-28000)
Description:Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.

Description

0Day CVE-2024-28000 Auto Exploiter on WordPress LiteSpeed Cache plugin

Readme

<h1 align="left">
  CVE-2024-28000 - 0Day Auto Exploit POC -  by <a href="https://t.me/bl4ckhatx" target="_blank">
      @bl4ckhatx 
  </a>
  <a href="https://t.me/bl4ckhatx" target="_blank">
    <img
      src="https://raw.githubusercontent.com/maurodesouza/profile-readme-generator/master/src/assets/icons/social/telegram/default.svg"
      width="32"
      height="32"
      alt="telegram logo"
    />
  </a>
</h1>

###

<h3 align="left">
  Unlock the potential of the latest vulnerability—CVE-2024-28000! For serious
  inquiries, <br />
  hit me up on Telegram: 
  <a href="https://t.me/bl4ckhatx" target="_blank">
      @bl4ckhatx 
  </a>
 

  <a href="https://t.me/bl4ckhatx" target="_blank">
    <img
      src="https://raw.githubusercontent.com/maurodesouza/profile-readme-generator/master/src/assets/icons/social/telegram/default.svg"
      width="20"
      height="20"
      alt="telegram logo"
    />
  </a>
</h3>

###

<div align="center">
  <img src="poc.png" />
</div>

###

<h2 align="left">
  🎯 CVE-2024-28000 - The Ultimate Backdoor to WordPress Domination💢

  <a href="https://t.me/bl4ckhatx" target="_blank">
    <img
      src="https://raw.githubusercontent.com/maurodesouza/profile-readme-generator/master/src/assets/icons/social/telegram/default.svg"
      width="20"
      height="20"
      alt="telegram logo"
    />
  </a>
</h2>

###

<h2 align="left">Exploitation Path: From Nobody to God Mode</h2>

###

<p align="left">
  Once you’ve cracked the hash, you’re golden. The plugin doesn't bother with
  real security checks, so your spoofed admin credentials will get you full
  control. You can now use the /wp-json/wp/v2/users REST API to create new
  admin-level accounts. With this access, the possibilities are endless: install
  malicious plugins, alter site content, steal user data, or simply crash the
  whole thing for kicks.
</p>

###

<h3 align="left">
  For more details or to secure a customized exploit kit, reach out on Telegram:
    <a href="https://t.me/bl4ckhatx" target="_blank">
      @bl4ckhatx 
  </a>
</h3>

###

<div align="left">
  <a href="https://t.me/bl4ckhatx" target="_blank">
    <img
      src="https://raw.githubusercontent.com/maurodesouza/profile-readme-generator/master/src/assets/icons/social/telegram/default.svg"
      width="52"
      height="40"
      alt="telegram logo"
    />
  </a>
</div>

###

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →