WordPress Plugin Flaw Escalates Unauthorized Access

A recently discovered WordPress plugin vulnerability allows unauthorized access to sensitive user information and cookie details. How to defend against this WordPress LiteSpeed flaw is something every user should know.

The LiteSpeed Cache plugin is a server-level data cache. The stored data creates faster access to webpages for those visitors to WordPress-built sites. This plugin stores frequently used data in the cache, allowing increased speed for website page loading and performance.

Officially tracked as CVE-2024-44000, this flaw affects versions 6.4.1 and earlier. This LiteSpeed exploit gives hackers the unauthorized access they need for attacks. It exposes sensitive information no user wants in the hands of hackers. That’s especially true when attackers escalate access privileges to the point of account takeovers (ATOs).

2

For LiteSpeed users, the debug feature must be enabled for this exploit to work. WordPress users should know the debug feature is on by default and must be disabled manually. It’s also a reminder for those who turned the feature on for a period of time should check and make sure it’s turned off.

The key to this plugin flaw gives hackers unauthorized access, and any logged-in LiteSpeed user with the debug feature enabled is at risk. Bad actors reach Administrator level privileges allowing them to install malicious plugins for further attacks and ATOs leading to identity theft and financial thievery.

WordPress now recommends users update to version 6.5.0.1. Other than making sure the debug feature is turned off, all WordPress users should keep their websites updated, patched and secured. If websites are outsourced, make sure the hosts are vetted to ensure they’re taking the best possible measures to protect the website.

While WordPress continues to wrangle with flaws, it’s likely more will continue being found and exploited. Keeping tabs on their security news is a great way to stay safer—for you and your websites.