CVE-2024-44000

WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

9.8 CriticalPublic exploit

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

82.3%Up 82.2 points since Oct 21, 2024

What each source reports

CVE List Score used 9.8

WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

Record: CVE-2024-44000
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-522
Updated: 2026-11-02

EUVDEUVD-2024-40782 9.8

Record: EUVD-2024-40782
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rh5m-mw2h-v9rv 9.8

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache...

Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a before 6.5.0.1.

Record: GHSA-rh5m-mw2h-v9rv
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-522
Updated: 2026-11-02

NVD 9.8

Record: CVE-2024-44000
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-522
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Litespeed Cache 6.5.0.1 - Authentication Bypass	2025-03-28
Metasploit	Wordpress LiteSpeed Cache plugin cookie theft	2024-09-04
Nuclei	LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure
PoC in GitHub	absholi7ly/CVE-2024-44000-LiteSpeed-Cache	2024-09-06
PoC in GitHub	gbrsh/CVE-2024-44000	2024-09-06
PoC in GitHub	geniuszly/CVE-2024-44000	2024-10-10
PoC in GitHub	ifqygazhar/CVE-2024-44000-LiteSpeed-Cache	2024-09-16

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-44000 is a critical vulnerability (CVSS 9.8) in Litespeed Technologies Cache, published October 20, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.3%, the 99th percentile. No source names a fixed version.