LiteSpeed Cache CVE-2026-113501

Requires an authenticated low-privileged account at Subscriber level (CVSS PR:L), so the site must grant or allow such accounts - the description scopes it to 'sites in certain configurations,' e.g. open Subscriber self-registration, which is the primary limiting factor. The plugin version must be LiteSpeed Cache before 7.9.2. No end-user interaction is needed (UI:N), and the request is remote over the network (AV:N), but the high attack complexity (AC:H) indicates the attack is not reliably reproducible against all deployments. Impact is confined to dismissing admin notices the plugin marks non-dismissible - including the warning about publicly accessible sensitive files - and does not itself grant data access or code execution.

This is a genuinely low-severity, low-priority issue, and the multiple signals agree rather than conflict. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, base 3.1 Low) reflects that an authenticated low-privileged user (PR:L) can only achieve a limited integrity impact (I:L) with high attack complexity (AC:H) and no confidentiality or availability effect. SSVC reinforces this: Exploitation 'none' (no observed or public exploitation), Automatable 'no', and only 'partial' technical impact, which maps to vuln.today's 'monitor' decision label. There is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or probable exploitation; status is 'no public exploit identified at time of analysis.' The only nuance worth flagging for defenders is that the integrity impact - dismissing a non-dismissible admin notice - can suppress a warning that sensitive files may be publicly accessible, so the real-world concern is operational (an admin losing visibility of a separate misconfiguration) rather than direct compromise. Net: this is a correctly-rated low-risk authorization flaw, not a high-CVSS-but-low-risk mismatch; treat as routine patching, not an emergency.

On a WordPress site running LiteSpeed Cache before 7.9.2 that permits low-privilege accounts (e.g. open Subscriber registration), an attacker logs in with a Subscriber account and sends the admin-notice dismissal request. Because the handler performs no capability check and the nonce is not bound to the specific notice, the attacker can dismiss notices the plugin marks non-dismissible, including the warning that sensitive files may be publicly accessible - hiding that warning from administrators. No public exploit identified at time of analysis; the trigger mechanics beyond the missing capability check and unbound nonce are not further detailed in the available sources.