EUVD-2026-70583
GHSA-7xwg-w22f-9qwp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network SSRF with scope change to internal systems; C:L/I:L reflect partial info disclosure and limited internal service interaction, not full compromise.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.
AnalysisAI
Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The LiteSpeed Cache plugin must be installed and active on a WordPress installation running version 7.9 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) accurately characterizes a network-exposed, zero-friction SSRF: no authentication, no user interaction, low complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the LiteSpeed Cache plugin to a version beyond 7.9 - confirm the current patched release from the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-9-server-side-request-forgery-ssrf-vulnerability, as the exact fix version is not confirmed in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct immediate inventory of WordPress installations running LiteSpeed Cache plugin versions 7.9 or below and disable or uninstall the plugin unless functionality is irreplaceable; if removal is not possible, isolate the affected server from external internet access pending mitigation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Litespeed Cache
View allAuthentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
Privilege escalation in LiteSpeed Cache plugin for WordPress (versions up to and including 6.3.0.1) allows unauthenticat
Stored cross-site scripting in LiteSpeed Cache for WordPress (versions up to and including 5.7) allows remote unauthenti
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technolo
Relative Path Traversal vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Path Traversal.4.
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege
Missing Authorization vulnerability in LiteSpeed Technologies LiteSpeed Cache.7. Rated high severity (CVSS 8.2), this vu
Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to perm
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in version
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technolo
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers h
A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today