Live › vulnerability › CVE-2026-113501
Go to dashboardBefore 7.9.2, the LiteSpeed Cache WordPress plugin's admin-notice dismissal handler lacks a capability check, so a low-privileged Subscriber account can dismiss notices the plugin marks as non-dismissible. The notice that can be hidden includes a warning that sensitive files may be publicly accessible.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the LiteSpeed Cache WordPress plugin before 7.9.2 in certain configurations where a low-privileged authenticated user exists. The sources say the exposure depends on configuration, so sites with no Subscriber accounts or open registration are less exposed. Sites that only run the latest plugin can skip it.
No product ranges from the sources yet.
wp plugin get litespeed-cache --field=version7.9.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
This page as .md · .json · in your agent: get_signal("CVE-2026-113501")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.