Loading story…
Security monitoring in Japan recorded a rise in exploitation attempts against CVE-2023-40000, an unauthenticated stored cross-site scripting flaw in the WordPress LiteSpeed Cache plugin. The vulnerability affects versions earlier than 5.7.0.1 and can be abused through the _msg parameter of the /wp-json/litespeed/v1/cdn_status endpoint, allowing attackers to inject malicious script content into WordPress files or databases.
Researchers said successful exploitation could also enable attackers to create administrator accounts, increasing the risk of full site compromise. Observed activity increased sharply from May 21, with many attack sources traced to the Netherlands and Switzerland, and defenders were urged to update LiteSpeed Cache to version 5.7.0.1 or later immediately.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
In its June 14, 2024 report covering May 2024, MBSD-SOC said attacks against CVE-2023-40000 had increased and that most observed attack sources were in the Netherlands and Switzerland. The report warned exploitation could embed unauthorized scripts in WordPress files or databases or enable creation of administrator users, and urged users to update promptly.
MBSD-SOC reported that detections of attacks targeting CVE-2023-40000 in the WordPress LiteSpeed Cache plugin increased starting on May 21, 2024. The observed exploit activity abused the vulnerable /wp-json/litespeed/v1/cdn_status endpoint and injected script content via the result[_msg] parameter.
WPScan described CVE-2023-40000 as an unauthenticated stored cross-site scripting vulnerability affecting LiteSpeed Cache versions earlier than 5.7.0.1.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical vulnerability** in the LiteSpeed Cache plugin for WordPress can let attackers create new user accounts — including **administrator** accounts — on affected sites, potentially leading to full site takeover. The issue affects **unpatched versions prior to `6.4`** when the plugin is deployed on **Linux-based systems**; based on available information, the flaw is **not currently believed to be exploitable on Windows-based deployments**. The plugin developer has released a fix in **version `6.4`**, and authorities urged organizations and individuals using WordPress with LiteSpeed Cache to update immediately because **no alternative mitigations are available**. While exploitation of this specific flaw had **not been observed** at the time of reporting, prior vulnerabilities in the same product have been **widely exploited**, increasing the urgency of patching exposed sites.
Jun 29, 2026
A critical vulnerability in the WordPress **W3 Total Cache** plugin allows remote, unauthenticated attackers to execute arbitrary PHP commands on affected sites. Tracked as **`CVE-2025-9501`**, the flaw affects versions earlier than **`2.8.13`** and is tied to insufficient validation of user input in the plugin’s **`_parse_dynamic_mfunc()`** function. According to CSIRT.SK, the bug can be triggered through a specially crafted comment, creating a path to full system compromise on vulnerable WordPress installations. The issue carries a **CVSS v3 score of 9.0**, underscoring the risk to organizations running the plugin in production. Security updates were released by the vendor in **W3 Total Cache 2.8.13**, and defenders are being urged to upgrade immediately and review WordPress databases, site files, and logs for evidence of exploitation or malicious post-compromise activity.
Jul 24, 2026
A critical vulnerability (CVE-2025-9501) has been identified in the W3 Total Cache WordPress plugin, affecting versions prior to 2.8.13. This flaw allows unauthenticated attackers to execute arbitrary PHP commands on affected sites by submitting a specially crafted comment, exploiting the `_parse_dynamic_mfunc` function. The vulnerability has been assigned a CVSS score of 9.0, indicating a high risk of remote code execution, and potentially impacts up to 1 million WordPress sites using the vulnerable plugin version. Security researchers warn that exploitation of this vulnerability could allow attackers to fully compromise WordPress installations without authentication, leading to site defacement, data theft, or further malware deployment. Administrators are strongly advised to update W3 Total Cache to version 2.8.13 or later to mitigate the risk, as the vulnerability is remotely exploitable and poses a significant threat to a large number of websites.
Jun 29, 2026