CVE-2024-47637 HIGH

CVE-2024-47637: WordPress LiteSpeed Cache plugin <= 6.4.1 - Path Traversal vulnerability

Vendor Litespeed Technologies

Product LiteSpeed Cache

Weakness CWE-23

Published October 16, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.This issue affects LiteSpeed Cache: from n/a through <= 6.4.1.

Explanation of Vulnerability in Simple Terms

02Summary

LiteSpeed Cache versions up to 6.4.1 contain a path traversal vulnerability that allows authenticated users with low privileges to read, modify, or delete files on the server. An attacker can exploit this by crafting malicious requests to access files outside the intended directory. This affects confidentiality, integrity, and availability of the site.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete files on the server outside the cache directory.

Potential impact on your site

04Site Impact

Any authenticated user can access sensitive files, alter site configuration, or cause service disruption.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege authenticated account on the site.

Key dates

06Disclosure timeline

October 16, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-47637 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/23.html AskarLabs — CWE-23 write-up Relative Path Traversal

Related vulnerabilities