LiteSpeed Cache privileged user simulation relied on weak security tokens

Root cause

Privileged user simulation relied on a predictable, reusable token without adequate context binding.

Demonstrated impact

Unauthenticated users could obtain administrator privileges on affected installations. The advisory identifies an operating-system limitation, so plugin installation totals do not establish affected-site counts.

Lessons for review

• Use cryptographically secure token generation, explicit authorization, context binding and limited lifetimes.
• Treat impersonation and user-simulation features as privileged authentication boundaries.

Award and evidence

Read platform advisory, coordinated timeline, researcher interview and later platform retrospective.

• Exact award and payment dates are absent. The recorded component is not the later reported total.
• The advisory describes Windows-specific limitations.
• The disclosed patch added token checks and lifetime controls; the researcher’s recommended random-generator improvement was deferred for compatibility.

Recorded timeline

Published

2024-08-21explicit

Public Disclosure

2024-08-19explicit · Initial platform vulnerability-database publication preceded the full advisory.

Reported

2024-08-01explicit · Report received by Patchstack; vendor contacted August 5.

Fixed

2024-08-13explicit · Release of version 6.4.

Award Announced

2024-08-21explicit · Direct award amount stated in the advisory; earliest announcement not independently established.

Sources and provenance

1. LiteSpeed Cache CVE-2024-28000 coordinated advisory ↗Rafie Muhammad / Patchstack · reviewed 2026-10-02
2. Interview with John Blackbourn ↗Maciek Palmowski / Patchstack · reviewed 2026-10-02
3. State of WordPress Security 2025 ↗Patchstack · reviewed 2026-10-02

Record reviewed 2026-10-02. Snapshot d5550c789111. Open the complete JSON contract.