LiteSpeed Cache CVE-2026-84761

The LiteSpeed Cache plugin must be installed and active on a WordPress installation running version 7.9 or earlier. No authentication is required (PR:N) and no special configuration beyond the plugin being active is indicated - the CVSS AC:L confirms no additional conditions apply. Exploitation requires network-level HTTP access to the WordPress site (AV:N), which is satisfied by any internet-facing installation. Practical impact is amplified in cloud-hosted environments (AWS, GCP, Azure) where the WordPress server can reach instance metadata services or internal VPC endpoints not exposed externally. Exploitation is bounded by what internal hosts the WordPress server can reach via HTTP; direct code execution is not a typical first-order outcome of SSRF alone without a secondary vulnerability.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) accurately characterizes a network-exposed, zero-friction SSRF: no authentication, no user interaction, low complexity. The scope change is appropriate because SSRF inherently affects systems beyond the WordPress installation. The C:L/I:L ratings are conservative and realistic - SSRF alone yields partial information disclosure (reading internal HTTP responses) and limited interaction with internal services, not direct code execution. Real-world risk is meaningfully elevated by three factors: (1) massive deployment scale across millions of WordPress sites, (2) the unauthenticated trigger meaning every internet-facing install is exposed, and (3) cloud-hosted environments where SSRF can reach IMDSv1 endpoints to harvest IAM credentials. EPSS data is not provided in the intelligence, and the vulnerability does not appear in CISA KEV, suggesting automated mass exploitation has not been observed. Risk is lower for on-premise deployments with no reachable internal services. The CVSS C:L/I:L understates risk in cloud contexts and overstates it for isolated single-server deployments - defenders should evaluate based on their hosting environment.

An unauthenticated attacker sends a crafted HTTP request to a publicly accessible WordPress endpoint registered by LiteSpeed Cache ≤ 7.9, supplying a URL pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the SSRF target. The WordPress server fetches the URL and the attacker reads the response through an error message, debug output, or timing side-channel, retrieving AWS IAM role credentials that can then be used to escalate access within the cloud account. No public exploit code has been confirmed at time of analysis, but SSRF against WordPress plugin AJAX handlers is a well-documented attack pattern.