Critical LiteSpeed Cache Flaw Lets Attackers Create WordPress Admin Accounts

A critical vulnerability in the LiteSpeed Cache plugin for WordPress can let attackers create new user accounts — including administrator accounts — on affected sites, potentially leading to full site takeover. The issue affects unpatched versions prior to 6.4 when the plugin is deployed on Linux-based systems; based on available information, the flaw is not currently believed to be exploitable on Windows-based deployments.

The plugin developer has released a fix in version 6.4, and authorities urged organizations and individuals using WordPress with LiteSpeed Cache to update immediately because no alternative mitigations are available. While exploitation of this specific flaw had not been observed at the time of reporting, prior vulnerabilities in the same product have been widely exploited, increasing the urgency of patching exposed sites.