CVE-2024-44000: LiteSpeed Cache WordPress plugin authentication bypass via exposed credentials

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and very high EPSS make this an urgent patch-first issue despite no KEV listing.

What it is

LiteSpeed Cache versions before 6.5.0.1 contain an insufficiently protected credentials flaw (CWE-522) that allows authentication bypass. The reference describes it as an unauthenticated account takeover vulnerability, so any site running an affected version is exposed to full compromise of user accounts.

Impact

An unauthenticated attacker can bypass authentication and take over accounts, gaining the privileges of the compromised user, potentially including administrator access to the WordPress site.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw lives in the plugin's handling of credentials, so any site with the affected plugin version is a target.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.823 (99.6th percentile), indicating strong likelihood of exploitation activity. The single reference is a Patchstack advisory tagged as an unauthenticated account takeover, which points to active interest even though no public exploit tag is present.

What to do

• Update LiteSpeed Cache to 6.5.0.1 or later immediately.
• If patching is delayed, disable or remove the LiteSpeed Cache plugin until it can be updated.
• Rotate WordPress user passwords and invalidate active sessions after patching, since credentials may already have been exposed.
• Audit administrator accounts and review recent login and user-creation activity for signs of unauthorized access.
• Add virtual patching or WAF rules blocking requests that target the vulnerable credential-handling path if the plugin cannot be updated at once.

Detection

• Review web server and plugin logs for unusual requests to LiteSpeed Cache endpoints, especially from unauthenticated clients.
• Monitor WordPress authentication logs for logins or session creation from unexpected IPs or user agents.
• Check for new or modified administrator accounts and unexpected password reset or role-change events.
• Hunt for outbound connections or file changes consistent with post-exploitation activity on hosts running the affected plugin.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.