LiteSpeed Cache EUVD-2026-109251

The available sources (CWE-201, 'Retrieve Embedded Sensitive Data') establish that the plugin inserts sensitive information into data it sends, but the exact feature, endpoint, request, or configuration that triggers the disclosure is not described in the available sources. The CVSS metrics indicate no authentication (PR:N) and no user interaction (UI:N) are required, so the limiting factor is the high attack complexity (AC:H): exploitation depends on a non-trivial condition that is not spelled out in the evidence, rather than being a simple default-configuration read. Exploitation is confined to sites running LiteSpeed Cache versions from an unspecified start through 7.9.

This is a moderate-severity information-disclosure flaw (CVSS 5.9) in the LiteSpeed Cache WordPress plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, unauthenticated issue with high confidentiality impact but no integrity or availability impact - and critically AC:H (high attack complexity), which materially dampens real-world exploitability. The signals are largely consistent and point to a bounded risk: there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or probable mass exploitation. The only reference is a Patchstack advisory entry, which is a vulnerability catalog record, not verified working exploit code. The vuln.today decision label is 'this_month', signaling routine prioritization rather than emergency action. Net assessment: despite the unauthenticated network vector, the combination of high attack complexity, confidentiality-only impact, no KEV, and no public exploit makes this a patch-in-normal-cycle item rather than a drop-everything emergency - the main counterweight is the plugin's very large install base, which raises aggregate exposure. Note that the description does not explain how the sensitive data is exposed, so the precise trigger cannot be confirmed from the available sources.

A remote, unauthenticated attacker interacts with a site running a vulnerable LiteSpeed Cache version (through 7.9) and, under the specific non-trivial conditions implied by the high attack complexity, is able to retrieve embedded sensitive data that the plugin inserts into data it sends (CWE-201). No public exploit code has been identified, and the exact request or mechanism needed to trigger the disclosure is not described in the available sources. Because no authentication or user interaction is required (PR:N/UI:N), a successful technique would be reusable across exposed sites.