CVE-2024-44000 CRITICAL

CVE-2024-44000: WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

Vendor Litespeed Technologies
Product LiteSpeed Cache
Weakness CWE-522 · Insufficiently protected credentials
Published October 20, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.

Explanation of Vulnerability in Simple Terms

02Summary

LiteSpeed Cache versions up to 6.5.0.1 contain a vulnerability that allows unauthenticated attackers to read, modify, or delete sensitive data on the site without requiring user interaction. The vulnerability stems from improper credential storage or transmission. All versions from 0 through 6.5.0.1 are affected. Site administrators should update immediately to a version newer than 6.5.0.1.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete sensitive site data without authentication.

Potential impact on your site

04Site Impact

Attackers can compromise site data, user information, and site integrity without any credentials.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

October 20, 2024 CVE published
April 28, 2026 Record updated