LiteSpeed Cache CVE-2024-44000

Vendor-released patch: upgrade LiteSpeed Cache to version 6.5.0.1 or later via the WordPress plugin updater or by replacing the plugin directory from the official WordPress.org repository. Until the upgrade is applied, compensating controls include disabling the plugin's debug logging feature (which removes the source of the leaked session data, at the cost of losing diagnostic logging), blocking external HTTP access to wp-content/debug.log and the plugin's log directory at the web-server or WAF layer (which prevents remote retrieval of the credential material but does not address local-file disclosure paths), and rotating any potentially exposed administrator sessions by forcing logouts and resetting authentication keys/salts in wp-config.php (which will invalidate any session tokens an attacker may have already harvested but will log out legitimate users). Refer to the Patchstack advisory for the formal write-up.