CVE-2024-44000: litespeed technologies litespeed cache Insufficiently Protected Credentials
Vulnerability summary
CVE-2024-44000 is a critical (CVSS 9.8) Insufficiently Protected Credentials vulnerability in litespeed technologies litespeed cache. EPSS estimates a 82.34% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 6.5.0.1.
Timeline
- 20-10-2024PublishedVulnerability first disclosed.
- 28-04-2026Last modifiedVulnerability information updated.
Description
Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
82.34%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 82.34% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundLitespeed Cache 6.5.0.1 - Authentication Bypass
Maturity: poc
Wordpress LiteSpeed Cache plugin cookie theft
exploit/multi/http/wp_litespeed_cookie_theft
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Litespeed technologies1 product
- litespeed cache≤ 6.5.0.1
Litespeedtech1 product
- litespeed_cache< 6.5.0.1
Wordpress1 product
- litespeed-cache≤ 6.4.1 (fixed in 6.5.0.1)
3 vendors · 3 products
References
2 links- patchstack.com/database/…VDB Entry