LiteSpeed Cache CVE-2024-44000

Exploitation requires that the target site is running LiteSpeed Cache below 6.5.0.1 with the plugin's debug logging feature enabled and the resulting log file reachable over HTTP from the attacker's network position, and that at least one privileged user (typically an administrator) has an active or recent session whose identifier appears in those logs. No authentication, user interaction, or local access is required (PR:N/UI:N/AV:N), but sites that have never enabled debug logging or that block external access to wp-content log paths via .htaccess/nginx rules are not exposed via this path.

All signals point to this being a top-tier priority. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated path to full confidentiality, integrity, and availability impact. The EPSS score of 93.13% at the 100th percentile is exceptionally high, indicating real-world exploitation activity is essentially certain. Public POC code is confirmed available, which lowers the bar for opportunistic mass exploitation given the plugin's massive WordPress install base. CISA KEV status is not listed in the supplied data, so 'confirmed actively exploited (CISA KEV)' cannot be asserted here - however, the combination of public POC plus near-maximum EPSS strongly suggests exploitation is occurring even if not yet formally cataloged. No conflicts between the CVSS vector and the description were detected.

An attacker scans the internet for WordPress sites running vulnerable LiteSpeed Cache versions and requests the publicly reachable debug log file to harvest leaked session hash material. Using the published POC, they brute-force the limited hash space to derive a valid administrator session identifier and replay it as a cookie, gaining full wp-admin control. From there they install a malicious plugin or theme to achieve persistent code execution on the host.