CVE-2024-3246: LiteSpeed Cache CSRF Vulnerability

CVE-2024-3246 Overview

The LiteSpeed Cache plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 6.2.0.1. The flaw stems from missing or incorrect nonce validation in the plugin's cloud integration component. Unauthenticated attackers can update the token setting and inject malicious JavaScript through a forged request. Exploitation requires tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page. The vulnerability is tracked under [CWE-352] and impacts a widely deployed caching plugin used across millions of WordPress sites.

Critical Impact
Successful exploitation allows attackers to inject persistent JavaScript into a WordPress site by abusing administrator sessions, enabling site compromise, redirection, or credential theft.

Affected Products

LiteSpeed Cache plugin for WordPress, versions ≤ 6.2.0.1
WordPress installations running the vulnerable plugin with active administrator sessions
Sites relying on the plugin's QUIC.cloud integration and token settings

Discovery Timeline

2024-07-24 - CVE-2024-3246 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3246

Vulnerability Analysis

The vulnerability resides in the LiteSpeed Cache plugin's cloud integration handler, specifically in src/cloud.cls.php. This module manages communication with QUIC.cloud services and processes token-related settings. The affected code path fails to verify a valid WordPress nonce before accepting state-changing requests. Because the token setting influences downstream rendering, an attacker who controls its value can plant arbitrary JavaScript that executes in the browser of any user visiting affected pages.

The attack requires user interaction, as the attacker must convince an authenticated administrator to trigger the forged request. Once triggered, the request executes with the administrator's privileges without any additional authentication challenge. The injected JavaScript then persists in plugin configuration and executes in the context of the WordPress site.

Root Cause

The root cause is a broken CSRF defense pattern. WordPress provides nonce primitives via wp_verify_nonce() and check_admin_referer(), but the vulnerable handler either omits these checks entirely or applies them incorrectly. Without a validated nonce token, the plugin cannot distinguish legitimate administrator-initiated changes from cross-origin forgeries. Coupled with insufficient sanitization of the token value, this omission converts a CSRF issue into a stored script injection vector.

Attack Vector

An attacker crafts a malicious HTML page or link containing a forged request targeting the vulnerable endpoint. The attacker distributes the link via phishing email, social media, or a compromised third-party site. When a logged-in WordPress administrator visits the page, the browser submits the request with the administrator's cookies attached. The plugin processes the request, updates the token setting, and stores the attacker-supplied JavaScript payload for later execution against site visitors and staff.

Refer to the Wordfence Vulnerability Report and the upstream code changeset for the specific fix applied to cloud.cls.php.

Detection Methods for CVE-2024-3246

Indicators of Compromise

Unexpected modifications to LiteSpeed Cache token settings in the WordPress options table, particularly entries containing HTML or JavaScript syntax.
Outbound requests from administrator browsers to unfamiliar domains immediately after visiting third-party links.
Presence of unexpected <script> tags or event handlers rendered by the plugin in administrative or public pages.

Detection Strategies

Audit the wp_options table for LiteSpeed Cache configuration entries containing non-alphanumeric payloads or script fragments.
Review web server access logs for POST requests to LiteSpeed Cache admin endpoints lacking a valid Referer header matching the site origin.
Correlate administrator login sessions with subsequent plugin setting changes to identify anomalous update patterns.

Monitoring Recommendations

Enable WordPress audit logging to capture plugin configuration changes with user attribution and timestamps.
Deploy a web application firewall rule that inspects requests to LiteSpeed Cache admin endpoints for missing or invalid nonce parameters.
Monitor file integrity of plugin directories and alert on unexpected changes to src/cloud.cls.php or related option storage.

How to Mitigate CVE-2024-3246

Immediate Actions Required

Update the LiteSpeed Cache plugin to a version later than 6.2.0.1 through the WordPress admin dashboard or WP-CLI.
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.
Inspect and reset the LiteSpeed Cache token setting to remove any injected JavaScript payloads.

Patch Information

LiteSpeed Technologies addressed the vulnerability in the WordPress plugin repository. The fix adds proper nonce validation before processing token setting updates in the cloud integration module. Details of the code change are available in the WordPress plugin changeset. Site operators should confirm the installed version is beyond 6.2.0.1 and verify that automatic plugin updates are enabled.

Workarounds

Deactivate the LiteSpeed Cache plugin until patching is complete if immediate updates cannot be applied.
Restrict access to the WordPress administrative interface by IP allow-list at the web server or WAF layer.
Train administrators to avoid clicking untrusted links while authenticated to the WordPress admin console, and use a separate browser profile for administrative tasks.

bash

# Update LiteSpeed Cache using WP-CLI
wp plugin update litespeed-cache
wp plugin get litespeed-cache --field=version