{"id":"CVE-2026-113501","kind":"vulnerability","aliases":["CVE-2026-113501"],"related":[],"title":"LiteSpeed Cache WordPress plugin: subscribers can dismiss security warnings","description":"The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.","summary":"Before 7.9.2, the LiteSpeed Cache WordPress plugin's admin-notice dismissal handler lacks a capability check, so a low-privileged Subscriber account can dismiss notices the plugin marks as non-dismissible. The notice that can be hidden includes a warning that sensitive files may be publicly accessible.","severity":"low","cvss":3.1,"epss":0.00143,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["litespeed-cache","package","wordpress","wordpress-plugins"],"not_affected_if":["no-subscriber-accounts","plugin-version-7.9.2-or-later"],"how_to_check":"- Check the installed LiteSpeed Cache version in the WordPress Plugins screen or with `wp plugin get litespeed-cache --field=version`\n- Check whether the site allows open registration that assigns the Subscriber role","fix":"- Update LiteSpeed Cache to `7.9.2` or later\n- Review Subscriber accounts and remove any that are not needed","status":"open","published_at":"2026-10-23T06:17:06+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T04:47:20+00:00","updated_at":"2026-10-25T04:47:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:47:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update LiteSpeed Cache to `7.9.2` or later\n- Review Subscriber accounts and remove any that are not needed","reach":"internet","title":"LiteSpeed Cache WordPress plugin: subscribers can dismiss security warnings","impact":"low","summary":"Before 7.9.2, the LiteSpeed Cache WordPress plugin's admin-notice dismissal handler lacks a capability check, so a low-privileged Subscriber account can dismiss notices the plugin marks as non-dismissible. The notice that can be hidden includes a warning that sensitive files may be publicly accessible.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","litespeed-cache"],"confidence":0.7,"needs_auth":"yes","worst_case":"Subscriber hides a warning that sensitive files are publicly exposed","analyst_note":"","how_to_check":"- Check the installed LiteSpeed Cache version in the WordPress Plugins screen or with `wp plugin get litespeed-cache --field=version`\n- Check whether the site allows open registration that assigns the Subscriber role","needs_analyst":false,"not_affected_if":["plugin-version-7.9.2-or-later","no-subscriber-accounts"],"who_is_affected":"Sites running the LiteSpeed Cache WordPress plugin before 7.9.2 in certain configurations where a low-privileged authenticated user exists. The sources say the exposure depends on configuration, so sites with no Subscriber accounts or open registration are less exposed. Sites that only run the latest plugin can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000641,"input_tokens":3431,"output_tokens":595,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-113501':12A,15A '-2026':11A,14A '7.9.2':25B,80C,132C 'access':73B,147C 'account':47B 'admin':33B,90C 'admin-notic':32B,89C 'administr':124C 'authent':119C 'bound':102C 'cach':2A,18B,28B,76C,128C 'capabl':39B,85C 'certain':113C 'check':40B,86C 'configur':114C 'cve':10A,13A 'dismiss':7A,35B,49B,57B,92C,108C,123C,137C 'file':69B,143C 'handler':36B,93C 'hidden':63B 'includ':64B,138C 'lack':37B 'litespe':1A,17B,27B,75C,127C 'litespeed-cach':16B 'low':44B,117C 'low-privileg':43B,116C 'mark':53B,133C 'may':70B,144C 'non':56B,136C 'non-dismiss':55B,135C 'nonc':96C 'notic':34B,50B,59B,91C,106C,125C 'packag':19B 'perform':83C 'plugin':4A,23B,30B,52B,78C,130C 'privileg':45B,118C 'public':72B,146C 'reli':98C 'secur':8A 'sensit':68B,142C 'site':111C 'specif':105C 'subscrib':5A,46B,121C 'user':120C 'warn':9A,66B,140C 'wordpress':3A,20B,22B,29B,77C,129C 'wordpress-plugin':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the LiteSpeed Cache WordPress plugin before 7.9.2 in certain configurations where a low-privileged authenticated user exists. The sources say the exposure depends on configuration, so sites with no Subscriber accounts or open registration are less exposed. Sites that only run the latest plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113501","severity":null,"published_at":"2026-10-23T06:17:06+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113501","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113501","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}