Improper Access Control in LiteSpeed Cache WordPress Plugin
CVE-2026-113501
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-113501?
The LiteSpeed Cache plugin for WordPress, prior to version 7.9.2, features a significant security flaw where it fails to properly validate user capabilities when dismissing admin notices. This vulnerability allows low-privileged authenticated users, such as subscribers, to dismiss notices marked as non-dismissible by the plugin. Notably, it involves inadequate nonce verification that does not link the nonce to the specific notice being dismissed. This can lead to situations where important alerts, including those regarding potentially publicly accessible sensitive files, might be ignored due to the actions of unauthorized users.
Affected Version(s)
LiteSpeed Cache 0 < 7.9.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.