CVE-2026-113501: LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal

Q: Who can exploit this issue?

A low-privileged authenticated user, including a Subscriber, may be able to exploit it on sites in certain configurations. No administrative capability is required for the affected notice-dismissal handler.

Q: What does an attacker need to do to exploit it?

The attacker needs an authenticated low-privilege account and a nonce accepted by the notice-dismissal handler. The nonce is not bound to the particular administrative notice being dismissed.

Q: Are default installations affected?

The issue is described as affecting sites in certain configurations. The provided information does not establish that every default installation is affected.

Q: What is the practical impact?

An attacker can dismiss administrative notices that the plugin marks as non-dismissible, potentially hiding warnings from administrators. This includes a warning that sensitive files may be publicly accessible.

Q: Which versions need remediation?

LiteSpeed Cache versions before 7.9.2 are affected. Updating to 7.9.2 or later addresses the described vulnerable version range.

Published Oct 23, 2026

Updated

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.

Affected Software

1 affected component

LiteSpeed LiteSpeed Cache<7.9.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade LiteSpeed Cache WordPress plugin to a version that resolves this vulnerability.
Fixed in 7.9.2

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A low-privileged authenticated user, including a Subscriber, may be able to exploit it on sites in certain configurations. No administrative capability is required for the affected notice-dismissal handler.

What does an attacker need to do to exploit it?

The attacker needs an authenticated low-privilege account and a nonce accepted by the notice-dismissal handler. The nonce is not bound to the particular administrative notice being dismissed.

Are default installations affected?

The issue is described as affecting sites in certain configurations. The provided information does not establish that every default installation is affected.

What is the practical impact?

An attacker can dismiss administrative notices that the plugin marks as non-dismissible, potentially hiding warnings from administrators. This includes a warning that sensitive files may be publicly accessible.

Which versions need remediation?

LiteSpeed Cache versions before 7.9.2 are affected. Updating to 7.9.2 or later addresses the described vulnerable version range.

CVE-2026-113501: LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to exploit it?

Are default installations affected?

What is the practical impact?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to exploit it?

Are default installations affected?

What is the practical impact?

Which versions need remediation?