Patch removes all debug-level logging of HTTP response headers and request cookies, disables the “Log Cookies” option entirely, and relocates debug files into a hard-to-guess directory (/wp-content/litespeed/debug/) with randomized filenames based on the site’s AUTH_KEY. It also adds an index.php to block directory listings and updates .htaccess to deny direct access to log files, fully preventing unauthenticated attackers from downloading sensitive data.
This vulnerability affects the following application versions:
- LiteSpeed Cache 3.6.4
- LiteSpeed Cache 4.0
- LiteSpeed Cache 4.1
- LiteSpeed Cache 4.2
- LiteSpeed Cache 4.3
- LiteSpeed Cache 4.4
- LiteSpeed Cache 4.4.1
- LiteSpeed Cache 4.4.2
- LiteSpeed Cache 4.4.3
- LiteSpeed Cache 4.4.4
- LiteSpeed Cache 4.4.5
- LiteSpeed Cache 4.4.6
- LiteSpeed Cache 4.4.7
- LiteSpeed Cache 4.5
- LiteSpeed Cache 4.5.0.1
- LiteSpeed Cache 4.6
- LiteSpeed Cache 5.0
- LiteSpeed Cache 5.0.0.1
- LiteSpeed Cache 5.0.1
- LiteSpeed Cache 5.1
- LiteSpeed Cache 5.2
- LiteSpeed Cache 5.2.1
- LiteSpeed Cache 5.3
- LiteSpeed Cache 5.3.1
- LiteSpeed Cache 5.3.2
- LiteSpeed Cache 5.3.3
- LiteSpeed Cache 5.4
- LiteSpeed Cache 5.5
- LiteSpeed Cache 5.5.1
- LiteSpeed Cache 5.6
- LiteSpeed Cache 5.7
- LiteSpeed Cache 5.7.0.1
- LiteSpeed Cache 6.0
- LiteSpeed Cache 6.0.0.1
- LiteSpeed Cache 6.1
- LiteSpeed Cache 6.2
- LiteSpeed Cache 6.2.0.1
- LiteSpeed Cache 6.3
- LiteSpeed Cache 6.3.0.1
- LiteSpeed Cache 6.4
- LiteSpeed Cache 6.4.1