> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# LiteSpeed Cache Privilege Escalation PoC - CVE-2024-28000
- URL: https://darkwebinformer.com/litespeed-cache-privilege-escalation-poc-cve-2024-28000/
- Published: 2024-08-26T20:19:35.000Z
- Updated: 2025-09-04T22:27:13.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities

Direct Link: <https://github.com/ebrasha/CVE-2024-28000>  
Last Commit: August 26th, 2024

Always verify the code before running. I take no responsibility for what you do.

---

## 🎤 README Translation

[](https://github.com/ebrasha/CVE-2024-28000#-readme-translation)

- [English](https://github.com/ebrasha/CVE-2024-28000/blob/main/README.md)
- [فارسی](https://github.com/ebrasha/CVE-2024-28000/blob/main/README.fa.md)

## 📸 Screenshot

[](https://github.com/ebrasha/CVE-2024-28000#-screenshot)

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/08/090238490.jpg)

## 💎 Introduction

[](https://github.com/ebrasha/CVE-2024-28000#-introduction)

This repository contains a Proof of Concept (PoC) for a critical privilege escalation vulnerability discovered in the LiteSpeed Cache WordPress plugin. The vulnerability, identified as CVE-2024-28000, allows unauthorized users to gain Administrator-level access to a WordPress site by exploiting a weak security hash.

## 💀 Vulnerability Overview

[](https://github.com/ebrasha/CVE-2024-28000#-vulnerability-overview)

The LiteSpeed Cache plugin's user simulation feature is protected by a security hash that is weak and predictable. This PoC demonstrates how an attacker can brute-force the security hash, gaining access to Administrator privileges on a targeted WordPress site.

## 🛠️ Development Environment Setup

[](https://github.com/ebrasha/CVE-2024-28000#%EF%B8%8F-development-environment-setup)

- **.NET 8**
- **Newtonsoft.Json**

## 🔥 Requirements

[](https://github.com/ebrasha/CVE-2024-28000#-requirements)

There are no specific prerequisites needed to run this PoC.

## 📥 Download

[](https://github.com/ebrasha/CVE-2024-28000#-download)

To download the executable versions of this PoC, please visit the official Releases page on GitHub. This will allow you to obtain the compiled version ready for use:

- [Download Executable PoC Versions from GitHub](https://github.com/ebrasha/CVE-2024-28000/releases)

## 📦 Setup and Usage

[](https://github.com/ebrasha/CVE-2024-28000#-setup-and-usage)

To use this PoC, simply run the executable and provide the target URL, desired admin username, and password. The exploit will attempt to brute-force the security hash to gain administrator access.

## 😎 Expected Output

[](https://github.com/ebrasha/CVE-2024-28000#-expected-output)

If successful, the PoC allows unauthenticated users to gain Administrator-level access to a WordPress site by brute-forcing a weak security hash used in the plugin.

## ✅ Mitigation

[](https://github.com/ebrasha/CVE-2024-28000#-mitigation)

The vulnerability has been patched in LiteSpeed Cache plugin version 6.4 and above. It is strongly recommended to update to the latest version to avoid this exploit.

## 🎖️ Credit

[](https://github.com/ebrasha/CVE-2024-28000#%EF%B8%8F-credit)

- **Bug Founder**: John Blackbourn
- [Profile on Patchstack](https://patchstack.com/database/researcher/185b44a7-75e2-4c31-848d-a534cb44e821)

## ❤️ Donation

[](https://github.com/ebrasha/CVE-2024-28000#%EF%B8%8F-donation)

If you find this project helpful and would like to support further development, please consider making a donation:

- [Donate Here](https://ebrasha.com/abdal-donation)

## 🤵 Programmer

[](https://github.com/ebrasha/CVE-2024-28000#-programmer)

Handcrafted with Passion by **Ebrahim Shafiei (EbraSha)**

- **E-Mail**: [Prof.Shafiei@Gmail.com](mailto:Prof.Shafiei@Gmail.com)
- **Telegram**: [@ProfShafiei](https://t.me/ProfShafiei)

## ☠️ Reporting Issues

[](https://github.com/ebrasha/CVE-2024-28000#%EF%B8%8F-reporting-issues)

If you encounter any issues or have configuration problems, please reach out via email at [Prof.Shafiei@Gmail.com](mailto:Prof.Shafiei@Gmail.com). You can also report issues on GitLab or GitHub.

## ⚠️ Legal Disclaimer

[](https://github.com/ebrasha/CVE-2024-28000#%EF%B8%8F--legal-disclaimer)

This Proof of Concept (PoC) is provided for educational purposes only. Unauthorized use of this code on systems you do not own or have explicit permission to test is illegal and unethical. By using this PoC, you agree to take full responsibility for any misuse or damage that may result. The author disclaims all liability for actions taken based on the information provided in this repository. Always ensure you have proper authorization before conducting any security testing.