CVE-2024-44000 (LiteSpeed Cache Account Takeover) Ranks in June’s Top Threats

Byadmin

Introduction

June 2026 marked a significant escalation in hostile internet activity observed by honeynet sensors, with overall attack volume increasing by 55.5% month over month after three consecutive months of relative stability. The surge returned activity levels to those last seen during the major spike recorded earlier in the year, suggesting a renewed wave of internet wide scanning and opportunistic exploitation activity.

One of the most frequently observed vulnerabilities during the month was CVE-2024-44000, a critical account takeover flaw affecting the LiteSpeed Cache plugin for WordPress. Despite being disclosed nearly two years ago, the vulnerability continues to attract sustained automated reconnaissance, reflecting both the enduring value of exposed WordPress installations and the tendency for high impact vulnerabilities to remain embedded in attacker scanning playbooks long after patches become available.

LiteSpeed Cache Account Takeover (CVE-2024-44000)

CVE-2024-44000 is an unauthenticated account takeover vulnerability in the LiteSpeed Cache plugin for WordPress.

CVSS Score: 9.8 (Critical)
CWE: CWE-522 (Insufficiently Protected Credentials)
Affected Versions: LiteSpeed Cache for WordPress versions prior to 6.5.0.1
Authentication Required: None
Published: October 20, 2024

Successful exploitation can enable attackers to hijack active WordPress sessions and potentially obtain administrator level access to affected sites. Public proof-of-concept code and exploitation tooling have been released since disclosure, lowering the barrier to entry for opportunistic attackers.

Vulnerability Context

CVE-2024-44000 falls under “Insufficiently Protected Credentials” (CWE-522). It carries a CVSS score of 9.8 (Critical) with a network attack vector, affects all versions through 6.5.0.1, and was published October 20, 2024. It is not currently on the CISA KEV catalog.

Published 20 months ago, this is not a new vulnerability. Its continued appearance in mass-scanning traffic reflects the plugin’s large WordPress install base, which keeps it a worthwhile target for opportunistic operators long after disclosure.

How the Vulnerability Works

LiteSpeed Cache, under certain configurations, writes session and cookie data to a WordPress debug log at /wp-content/debug.log. When WordPress debug logging is enabled and the log file is world-readable and web-accessible, that file exposes sensitive authentication material.

The attack chain is:

  1. An unauthenticated attacker requests the debug log file directly over HTTP.
  2. The log contains logged session data and user cookies for users who were active while logging was enabled.
  3. The attacker extracts a valid session cookie and reuses it to authenticate as that user.

If a logged administrator’s session is present in the file, the attacker gains administrator access without ever guessing a password. The observed scanning is the first step of this chain: locating a readable debug log. No exploitation beyond reconnaissance is possible against low-interaction sensors, which return generic responses, so no compromise is confirmed here. The value of the data is confirming that automated hunting for the exploitation prerequisite is ongoing at scale.

Observed Exploit Behavior

Every event is classified as information leakage, and the request content is consistent across the fleet.

Path variants. The scanner probes multiple candidate locations, reflecting awareness that operators relocate or nest the log file:

  • GET /wp-content/debug.log (primary, highest volume)

  • GET /wp-content/uploads/wp-content/debug.log

  • GET /logs/wp-content/debug.log

  • GET /wordpress/wp-content/debug.log

  • GET /wp-content/debug.log.1 (rotated log)

It also tests URL-encoding evasion with debug%2elog (encoded period) and appends cache-busting query strings such as debug.log?_=2hr95nxf&v=0a57s. The encoding variants and rotation-file probes indicate purpose-built tooling for this specific CVE, not a generic path-traversal fuzzer.

HTTP characteristics. All requests use HTTP/1.0 with Connection: close, typical of lightweight scripts rather than browsers. Two spoofed User-Agent strings dominate and appear across unrelated source IPs, a reliable fingerprint of shared tooling:

  • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (truncated, no Chrome version)

  • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 (a frozen 2017-era build)

Header casing varies between requests (accept/user-agent lowercase versus Accept/User-Agent titlecase), suggesting at least two builds or code paths within the same operation.

The X-Real-IP and X-Forwarded-For headers echo the scanner’s own source IP in every request. This is the tool setting these headers itself, either to appear as proxied traffic or to test for header-based access control bypass on the log path.

The same fleet issued identical debug.log requests against every emulated service it encountered, regardless of application type. This is indiscriminate probing, not target-aware exploitation.

Threat Assessment

The evidence points to a single opportunistic scanning operation using shared, purpose-built tooling distributed across rented VPS infrastructure. Attribution is infrastructure-based only; the source countries reflect hosting-provider locations, not operator nationality.

The CVE-2024-44000 signatures fire alongside CVE-2005-0869 (a phpSysInfo path-disclosure vulnerability published in 2005) at near-identical per-IP counts. This is a signature co-occurrence artifact: the same scanner walks the same target list and fires a distinct signature per endpoint it probes. The two checks target completely different URL paths (debug.log versus phpsysinfo/info.php), so this is one tool with a broad check library, not an operator chaining exploits. For defenders, blocking one path does nothing for the other.

MITRE ATT&CK Mapping

Table 1: MITRE ATT&CK mapping

Top CVEs for June 2026

Table 2: Top 10 CVEs for June 2026

Trending CVEs for June

The top three positions remain dominated by long-standing PHP-focused exploits, with CVE-2024-4577 leading at 14,706 attacks (+990) and CVE-2017-9841 close behind at 11,585 (+1,230). Two newcomers entered the Top 10 this month: CVE-2021-26855 (ProxyLogon) debuted at #4 with 3,163 attacks, and the aging CVE-2005-0869 phpSysInfo information disclosure appeared at #9 with 1,846 attacks. Two CVEs fell out of the Top 10: CVE-2025-55184 dropped five places from #7 to #12, and CVE-2007-6672 slipped from #10 to #11. Microsoft Exchange exploitation is notably prominent, with four distinct Exchange-related CVEs now active in the ranking.

CVE-2021-26855

The ProxyLogon Exchange SSRF chain (CVSS 9.1) enters the Top 10 as a newcomer at #4 with 3,163 attacks. Its sudden reappearance, alongside CVE-2022-41082, CVE-2021-34523, points to a coordinated resurgence in Exchange targeting. Defenders running on-premise Exchange should verify patch levels for ProxyLogon and ProxyShell chains, as attackers appear to be sweeping for unpatched servers. Combined Exchange-related activity across four CVEs signals renewed adversary interest in this attack surface.

CVE-2025-55182

The React Server Components pre-auth RCE (CVSS 10.0) nearly doubled its volume to 3,086 attacks, a jump of +1,526 that ranks it #5. This is the largest single-month increase in the table and the only perfect-severity vulnerability present. The rapid escalation suggests weaponization has matured and scanning is now broad and automated. Teams operating React-based server-side rendering should treat this as an immediate priority.

CVE-2024-44000

The LiteSpeed Cache credential exposure flaw (CVSS 9.8) surged +1,128 to reach 2,603 attacks at #8. This near-doubling reflects sustained interest in WordPress plugin ecosystems, where credential theft enables persistent access. Successful exploitation can hand attackers valid session data, bypassing authentication entirely. Administrators should ensure the plugin is updated and review logs for signs of credential harvesting.

CVE-2005-0869

A two-decade-old phpSysInfo information disclosure (CVSS 5.0) is a surprising Top 10 newcomer at #9 with 1,846 attacks. Its low severity contrasts sharply with the RCE-heavy remainder of the table, indicating opportunistic reconnaissance rather than direct compromise. Attackers likely use these probes to fingerprint exposed systems and gather host details for follow-on targeting. Its presence underscores that legacy, unmaintained web components remain a persistent scanning target.

CVE-2025-55184

CVE-2025-55184 fell five places from #7 to #12, the sharpest decline observed this month. The drop suggests attacker attention has rotated toward higher-yield targets such as CVE-2025-55182, which climbed to #5. Despite the reduced ranking, defenders should not deprioritize remediation, as declining sensor volume often reflects shifting campaign focus rather than diminished risk. Continued monitoring is warranted in case activity rebounds.

Long Term Targeting Trends

Top CVEs

Stacked line graph showing monthly exploitation activity for the most targeted CVEs from mid-2025 through June 2026. CVE-2024-4577 rises sharply from late 2025 and becomes the dominant threat throughout 2026, while legacy vulnerabilities CVE-2017-9841 and CVE-2018-20062 peak in late 2025 before stabilizing at consistently high levels. CVE-2021-26855 (ProxyLogon) shows renewed growth during 2026, reaching its highest observed level in June, highlighting continued attacker interest in unpatched Microsoft Exchange servers.

Figure 1: Six-month stacked graph of the top 5 CVEs.

In June 2026, exploitation of CVE-2024-4577 led the field with 14,706 sessions, closely trailed by CVE-2017-9841 at 11,585 and CVE-2018-20062 at 10,267. CVE-2024-4577 remains the most striking trend: dormant through most of 2025, it surged from 8,102 sessions in Dec 2025 to a sustained 12,000 to 16,000 per month thereafter, indicating attackers have operationalized this PHP-CGI argument injection flaw at scale. The long-standing phpMyAdmin and Webmin vulnerabilities (CVE-2017-9841 and CVE-2018-20062) both peaked in Nov 2025 at 27,075 and 22,635 respectively, then settled into steady five-figure activity, confirming persistent commodity scanning against legacy web stacks. CVE-2021-26855 (Exchange ProxyLogon) re-emerged in Jan 2026 and spiked to 3,163 sessions in June 2026, its highest yet. Defenders should prioritize patching PHP-CGI deployments immediately given CVE-2024-4577’s sustained growth, and treat the ProxyLogon resurgence as evidence that unpatched Exchange servers remain actively targeted years after disclosure.

Attack Types Over Time

Stacked line graph showing monthly web attack activity by vulnerability class. Predictable Resource Location remains the dominant category and increases significantly in June 2026, while Information Leakage records the steepest month over month growth. Path Traversal activity also rises sharply alongside continued high volumes of Server Side Code Injection and Command Execution attacks, illustrating a broader shift from large scale discovery and reconnaissance toward targeted enumeration and exploitation.

Figure 2: Evolution of attack types over 6 months.

In June 2026, Predictable Resource Location dominated observed activity at 1,375,666 events, up 49% from 923,312 in May and reinforcing its role as the leading reconnaissance vector against exposed files and directories. Information Leakage showed the sharpest surge, climbing 77% to 1,149,567 from 647,707, indicating attackers are increasingly harvesting configuration data, error messages, and metadata to inform follow-on exploitation. Path Traversal also spiked 55% to 98,172 from 63,171, a notable rise that pairs logically with the resource-discovery uptick. Code-oriented attacks remained heavy, with Server Side Code Injection at 626,075 and Command Execution at 553,279, both trending upward month over month. Defenders should prioritize suppressing verbose error output, locking down predictable paths and directory listings, and tightening input validation against traversal and injection, since the shifting mix points to attackers moving from broad scanning toward targeted enumeration and code execution.

Top Source Countries

Stacked bar chart showing monthly attack activity by source country. The United States remains the largest source of observed attacks and records a substantial increase in June 2026. Germany and France contribute the next highest volumes, with France showing particularly strong growth, while Singapore also rises significantly. China appears as a new source of activity after no observed events in the previous month, indicating a notable shift in the geographic distribution of attack traffic toward a broader set of hosting and cloud infrastructure locations.

Figure 3: Source country geographical distribution.

The United States remains the dominant origin of attack traffic against our honeynet sensors, surging to 7,731,747 events in June 2026 from 4,320,740 the prior month, a 79% increase that accounts for the single largest share of observed activity. Germany and France follow at 3,372,231 and 2,850,067 respectively, with France posting the sharpest proportional rise among established sources, up 83% from 1,553,570. Singapore climbed 71% to 1,179,972, signaling growing use of regional cloud and hosting infrastructure by attackers. Most notable is China, which registered 690,212 events after showing zero in the prior month, marking it as a newly active origin that warrants immediate monitoring attention. Defenders should recognize that leading sources are heavily concentrated in high-reputation hosting regions, so blanket geo-blocking of US, DE, FR, and SG traffic risks significant collateral impact; prioritize granular ASN-level filtering and elevated logging for the emergent Chinese activity instead.

Top Target Destinations

Bar chart comparing the dominant attack patterns observed across honeynet sensor locations. United Kingdom sensors show elevated credential brute force and authentication attacks against remote access services. United States sensors receive the broadest range of activity, with strong concentrations of web exploitation, remote code execution, and authentication bypass attempts. Japan is distinguished by command injection and exploitation targeting networking and edge devices. Canada shows a mix of web application attacks, file upload abuse, and post-exploitation activity indicative of persistence attempts. Singapore records substantial remote code execution activity focused on enterprise applications, gateways, and proxy services, reflecting its role as a major connectivity hub.

Figure 4: Destination target geographical distribution (normalized per sensor).

United Kingdom

Sensors in the United Kingdom saw a notable emphasis on credential brute-forcing against remote administration and login portals. Unlike other regions, the activity here showed sustained low-and-slow authentication attempts consistent with targeted access harvesting rather than pure noise.

United States

Sensors deployed in the United States absorbed the broadest spread of activity, dominated by remote code execution attempts and web application exploitation against internet-facing services. What distinguishes this location is the persistent probing for authentication bypass flaws, suggesting adversaries treat it as a primary staging ground for opportunistic mass exploitation.

Japan

Traffic reaching our Japanese sensors leaned heavily toward command injection attempts against edge and networking appliances. The distinctive marker here was a concentration of automated exploitation aimed at embedded device management interfaces rather than conventional web servers.

Canada

Canadian deployments saw persistent web application exploitation alongside attempts to leverage file upload and traversal weaknesses. Distinctively, this location attracted follow-on activity suggesting attackers sought to establish persistence after initial access probes.

Singapore

Sensors in Singapore recorded significant remote code execution attempts against internet-exposed enterprise applications. The distinctive element here was the targeting of gateway and proxy services, reflecting the region’s role as a connectivity hub.

Conclusion

June 2026 marked a notable shift in the threat landscape, with overall attack activity increasing by more than 55% and returning to levels last observed during the major surge earlier in the year. The data suggests that attackers are not simply increasing scan volume, but broadening the scope of their targeting. Information leakage, predictable resource discovery, path traversal, and code execution activity all increased simultaneously, indicating a progression from wide scale reconnaissance toward more deliberate attempts to identify and exploit vulnerable systems.

CVE-2024-44000 exemplifies this trend. Although the vulnerability was disclosed nearly two years ago, automated reconnaissance targeting exposed WordPress debug logs remains active and persistent. The observed activity demonstrates a recurring reality of internet facing security: vulnerabilities with low exploitation costs, high potential impact, and large deployment footprints can remain attractive targets long after patches become available. The continued prominence of Exchange vulnerabilities, legacy PHP application flaws, and newly weaponized targets such as CVE-2025-55182 further reinforces that attackers routinely blend old and new techniques in the same scanning campaigns.

Perhaps the most important takeaway from June’s telemetry is that opportunistic actors continue to achieve scale through automation. The majority of observed activity was indiscriminate and infrastructure driven, originating from distributed hosting environments and applying the same checks across broad target sets. Organizations should therefore focus on reducing exposure through timely patching, eliminating unnecessary information disclosure, restricting access to administrative and debugging functionality, and maintaining visibility into internet facing assets. As attack volumes continue to rise, basic exposure management and rapid remediation remain among the most effective defenses against both emerging and long standing threats.

Recommendations

For WordPress operators running LiteSpeed Cache at or below version 6.5.0.1 with debug logging enabled, a successful read of the debug log can leak active session cookies and lead to administrator account takeover.

  1. Patch LiteSpeed Cache to a version above 6.5.0.1 and disable debug logging in production. If logging is required, ensure the log path is not web-accessible.
  2. Block web access to log paths. Deny external requests to /wp-content/debug.log, debug.log.1, and nested variants including /wp-content/uploads/wp-content/debug.log and /logs/wp-content/debug.log. Account for URL-encoded evasion such as debug%2elog.
  3. Rotate WordPress secrets and force re-authentication if you ran a vulnerable version with debug logging enabled, since session cookies may already be exposed.
  4. Audit admin accounts for unexpected sessions, new administrator users, or anomalous logins.
  5. Prioritize signature-based blocking on the log paths over IP blocking. Blocking the top cluster (5.189.184.50, 2.59.156.103, 144.126.159.74, 103.200.219.112, 195.26.240.180) reduces log noise, but source IPs rotate; path-based controls are more durable.

Similar Posts

Leave a Reply