LiteSpeed Cache CVE-2026-76579

Exploitation requires the target running LiteSpeed Cache <=7.9 for WordPress with the ESI (Edge Side Includes) feature path reachable. The attacker must (1) supply a VALIDLY SIGNED 'esi' value in the GET query string, and (2) simultaneously send a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order so the POST value overrides the GET value at execution. Limiting factors: user interaction is mandatory (victim must click a link or submit the crafted request, UI:R), and the requirement to produce a validly signed GET esi value plus the two-parameter delivery raises complexity (AC:H). No account is needed (PR:N/unauthenticated). Impact is client-side only (C:L/I:L, A:N).

This is a genuinely lower-priority reflected XSS despite affecting an extremely widely-deployed plugin. The vendor CVSS of 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) is well-calibrated: while network-reachable and unauthenticated (PR:N), exploitation is throttled by AC:H and UI:R. The AC:H is not boilerplate - the attacker must supply a VALIDLY SIGNED 'esi' value in the GET query string AND a separate attacker-controlled 'esi' payload in the POST body, deliberately abusing PHP's default $_REQUEST merge order so the POST value wins at the execution point. Obtaining/forging the signed GET value plus the dual-parameter delivery is a real barrier. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was provided. Net: a legitimately CVSS-medium client-side flaw in a ubiquitous plugin, but the signed-value + user-interaction requirements keep real-world risk modest rather than a mass-exploitation candidate. Absence of EPSS/KEV/POC is a data gap, not a contradiction - signals are internally consistent.

An attacker crafts a URL containing a validly signed 'esi' GET value pointing at a LiteSpeed Cache ESI endpoint, then delivers a page/form that auto-submits a POST to that URL carrying a malicious 'esi' body field. When a logged-in or anonymous victim is tricked into triggering the request, PHP's $_REQUEST merge causes the POST payload to take precedence and the unsanitized script reflects into the response, executing in the victim's browser. No public exploit code was identified in the provided data.