CVE-2023-45000: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2023-45000) affects LiteSpeed Technologies' LiteSpeed Cache WordPress plugin versions through 5.7. It was discovered on October 17, 2023, and publicly disclosed on February 27, 2024. The vulnerability is classified as a Missing Authorization issue, specifically related to an unauthenticated broken access control on the plugin's API (Patchstack).

The vulnerability stems from a missing authorization check in the 'update_cdn_status' function, which allows unauthenticated attackers to modify the plugin's CDN status. It has been assigned CWE-862 (Missing Authorization) and received a CVSS v3.1 base score of 8.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (WPScan, Patchstack).

The vulnerability allows unauthorized modification of data, specifically enabling unauthenticated attackers to modify the plugin's CDN status. This broken access control issue is considered highly dangerous and is expected to become mass exploited (Patchstack).

The vulnerability requires no authentication to exploit and has a low attack complexity, as indicated by the CVSS vector string. No user interaction is needed for exploitation, making it particularly concerning for website security (Patchstack).

The vulnerability has been fixed in version 5.7.0.1 of the LiteSpeed Cache plugin. Website administrators are strongly advised to update to this version or later immediately. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking any attacks until the update to a fixed version can be completed (Patchstack).