{"id":"CVE-2026-114190","kind":"vulnerability","aliases":["CVE-2026-114190"],"related":[],"title":"LiteSpeed Cache WordPress plugin leaks embedded sensitive data in responses","description":"Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.","summary":"LiteSpeed Cache, a WordPress caching plugin, inserts sensitive information into data it sends out, so a remote party can retrieve embedded secrets. The advisory affects all versions through 7.9.","severity":"medium","cvss":5.9,"epss":0.00332,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["litespeed-cache","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of LiteSpeed Cache in the WordPress admin under Plugins, or with `wp plugin get litespeed-cache --field=version`\n- Compare the result against the fixed version, which the sources do not state","fix":"- Update LiteSpeed Cache to a release newer than `7.9`, once the vendor publishes a fixed version; the sources do not name it\n- Rotate any secrets stored in the site configuration if the site ran an affected version exposed to the internet","status":"open","published_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","triaged_at":"2026-10-25T04:07:53+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:07:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update LiteSpeed Cache to a release newer than `7.9`, once the vendor publishes a fixed version; the sources do not name it\n- Rotate any secrets stored in the site configuration if the site ran an affected version exposed to the internet","reach":"internet","title":"LiteSpeed Cache WordPress plugin leaks embedded sensitive data in responses","impact":"medium","summary":"LiteSpeed Cache, a WordPress caching plugin, inserts sensitive information into data it sends out, so a remote party can retrieve embedded secrets. The advisory affects all versions through 7.9.","category":"package","nicknames":[],"who_cares":["wordpress","litespeed-cache","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote party reads embedded sensitive data from site responses","analyst_note":"Check the NVD entry and the WordPress plugin changelog for the fixed version and the exact sensitive data exposed.","how_to_check":"- Check the installed version of LiteSpeed Cache in the WordPress admin under Plugins, or with `wp plugin get litespeed-cache --field=version`\n- Compare the result against the fixed version, which the sources do not state","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the LiteSpeed Cache WordPress plugin at version 7.9 or earlier are in scope, according to the NVD entry. The sources do not describe the exact data path or configuration needed, so unknown whether default installs are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3337,"output_tokens":584,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114190':13A,16A '-2026':12A,15A '7.9':53B,85C 'advisori':48B 'affect':49B,79C 'allow':73C 'cach':2A,19B,26B,29B,67C,69C,72C,81C 'cve':11A,14A 'data':8A,35B,60C 'data.this':77C 'embed':6A,45B,75C 'hai':63C 'host':23B 'inform':33B,57C 'insert':31B,54C 'issu':78C 'leak':5A 'lite':65C 'litespe':1A,18B,25B,68C,71C,80C 'litespeed-cach':17B,70C 'n/a':83C 'packag':20B 'parti':42B 'plugin':4A,30B 'remot':41B 'respons':10A 'retriev':44B,74C 'secret':46B 'self':22B 'self-host':21B 'send':37B 'sensit':7A,32B,56C,76C 'sent':59C 'speed':66C 'version':51B 'vulner':61C 'wordpress':3A,24B,28B 'zheng':64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the LiteSpeed Cache WordPress plugin at version 7.9 or earlier are in scope, according to the NVD entry. The sources do not describe the exact data path or configuration needed, so unknown whether default installs are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T08:16:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114190","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114190","severity":null,"published_at":"2026-10-24T08:16:51+00:00","modified_at":"2026-10-24T08:16:51+00:00","first_seen_at":"2026-10-24T08:47:15+00:00","fetched_at":"2026-10-24T08:47:15+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114190","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114190","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}