CVE-2026-113501 in Cache Plugin
Summary
by MITRE • 10/23/2026
The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in LiteSpeed Cache versions prior to 7.9.2 represents a significant flaw in access control logic within the WordPress administration interface. Specifically, the admin-notice dismissal handler fails to enforce proper capability checks, which are essential for restricting administrative actions to users with appropriate privileges. In a secure implementation, any action that modifies site configuration or suppresses critical security warnings must be validated against the user's role and capabilities defined by the Content Management System framework. The absence of this validation allows low-privileged authenticated users, such as those assigned the Subscriber role, to execute administrative functions intended exclusively for administrators. This misalignment between user privilege levels and action permissions constitutes a classic Broken Access Control vulnerability, often categorized under CWE-269 in industry standards.
Furthermore, the technical implementation relies on nonces that are not bound to specific notice identifiers or contextual parameters. Nonces in WordPress are designed to prevent Cross-Site Request Forgery by ensuring that requests originate from legitimate sources and correspond to intended actions. However, when a nonce is generic rather than context-specific, it can be reused across different operations or exploited if the request structure allows for parameter manipulation. In this scenario, the lack of binding means that an attacker does not need to forge a complex payload; they merely need valid authentication credentials at any low-privileged level and access to trigger the dismissal endpoint. This simplifies the attack vector significantly, reducing it from a potential Cross-Site Request Forgery exploit to a straightforward privilege escalation via improper authorization checks.
The operational impact of this vulnerability is primarily related to information disclosure and security awareness degradation. The LiteSpeed Cache plugin generates administrative notices to alert site administrators about critical issues, such as sensitive files being publicly accessible due to misconfigurations or server exposure. These warnings are marked as non-dismissible by design to ensure that administrators address potential security risks promptly. By allowing a low-privileged user to dismiss these notifications, the vulnerability effectively blindsides the system administrator regarding active threats. This can lead to prolonged periods where critical vulnerabilities remain unaddressed because the primary indicators of compromise or misconfiguration have been hidden from view. While this does not directly allow for code execution or data exfiltration by itself, it facilitates a broader attack chain by obscuring evidence and delaying remediation efforts.
From an adversarial perspective, as mapped in the MITRE ATT&CK framework, this behavior aligns with techniques involving Privilege Escalation via Improper Access Control and potentially Defense Evasion through Log or Event Manipulation if the dismissal action leaves no audit trail for the suppression of warnings. The attacker leverages valid credentials to perform actions outside their authorized scope, which is a fundamental breach of security principles. Although the immediate risk might seem limited to UI manipulation, in complex WordPress environments with multiple plugins and user roles, such flaws can be chained with other vulnerabilities or used as part of social engineering campaigns where an attacker manipulates low-level users into hiding critical alerts from administrators.
To mitigate this vulnerability, site owners must upgrade the LiteSpeed Cache plugin to version 7.9.2 or later immediately. This update includes patches that enforce strict capability checks on all administrative handlers and ensure nonces are correctly bound to specific contexts. Additionally, organizations should review their WordPress user roles and capabilities to minimize the number of users with any level of access to the admin dashboard. Implementing multi-factor authentication for all administrator accounts adds an extra layer of security against credential theft that could be used to exploit such flaws. Regular auditing of plugin code and adherence to secure coding standards that mandate explicit authorization checks before performing state-changing operations are essential practices to prevent similar issues in future updates or other plugins.