In a recent development, a serious vulnerability has been discovered in the popular LiteSpeed Cache plugin for WordPress, posing a potential security threat to user accounts. This vulnerability, identified as CVE-2024-44000 with a CVSS score of 7.5, affects versions up to 6.4.1.
The vulnerability allows unauthorized users to gain access to authorized user accounts, including administrators, as highlighted by PATCHSTACK’s Rafi Muhammad in a report at this link. This could potentially lead to the installation of malicious plugins and other nefarious activities on affected sites.
The root cause of the vulnerability lies in the open access to the debugging log “/wp-content/debug.log”, which contains sensitive information such as cookies and active user sessions. This loophole could enable attackers to compromise accounts without proper authorization.
Although the vulnerability is not considered a widespread threat, sites that have previously enabled the debugging function without deleting the log file are particularly at risk. The latest plugin update, LiteSpeed Cache 6.5.0.1, addresses this issue by relocating the log file to a new directory, generating a random filename, and obfuscating cookie data.
As a precautionary measure, users are advised to check for the presence of “/wp-content/debug.log” file and delete it if debugging was previously enabled. Additionally, experts recommend implementing access restrictions in “.htaccess” to further secure the log files and prevent unauthorized access.
This discovery underscores the significance of properly configuring debugging settings and log management to mitigate the risks of data exposure. It is worth noting that this is not the first vulnerability detected in the LiteSpeed Cache plugin in recent weeks, as a separate security flaw (CVE-2024-28000) was also reported earlier, potentially impacting millions of websites.