LiteSpeed has published an advisory for a flaw in its LiteSpeed Cache plugin for WordPress. On sites with a specific setup, it can let an unauthenticated attacker retrieve data that normally requires administrator access. The fix shipped in version 7.9.1 on September 1. According to LiteSpeed’s October 28 advisory, an exposed response stays cached for the REST cache lifetime, seven days by default, and clearing it requires a manual Purge All.

LiteSpeed Cache has more than 7 million active installations, according to wordpress.org. The flaw, tracked as CVE-2026-114190, was reported by Patchstack in August and carries a CVSS score of 5.9, a medium rating. Five days earlier, the company published an advisory for three further flaws fixed in version 7.9.2.

Three Conditions Behind the Exposure

LiteSpeed’s advisory names three conditions that must all apply. First, REST API caching is enabled, which is the plugin’s default. Second, the site uses plain permalinks, with URLs such as example.com/?p=123. Third, a legitimate integration that does not use cookies, such as a mobile app, a headless front end or a backup service authenticating with an application password, makes admin-level REST API calls.

The plugin’s description on wordpress.org places caching of WordPress REST API calls among its LiteSpeed Exclusive Features. Those features require OpenLiteSpeed, a commercial LiteSpeed product, LiteSpeed-powered hosting or the QUIC.cloud CDN.

A Cron Purge Does Not Clear the Cached Entry

LiteSpeed’s advisory also addresses sensitive responses already stored in the cache. Clearing them requires a manual Purge All from the WordPress dashboard, and a cron-based purge is not effective in this case.

For the flaw itself, LiteSpeed recommends that every site update to the latest version, currently 7.9.2, and sees nothing further to do for sites that keep the plugin up to date. It asks those that have not updated in a while to do so today.

Patchstack, which found the flaw, notes that no mitigation rule can be assigned to it and points to an update to 7.9.1 or later as the fix.

Three LiteSpeed Security Builds in Six Days: Check Which One Your Servers Run

Further Fixes in Version 7.9.2

Version 7.9.2, which the wordpress.org changelog dates to October 20, fixes the flaws covered by LiteSpeed’s October 23 advisory. Two of them, CVE-2026-113499 and CVE-2026-113500, are stored cross-site scripting issues that CISA rates 7.5, a high score, in the CVE records. An unauthenticated visitor can trigger them through a published comment on sites whose theme prints the comment author’s name without escaping it. The first also requires CDN Mapping to be on, with a CDN URL defined and Include Images enabled. The second requires Font Display Optimization set to Swap. LiteSpeed suggests comment moderation as a stopgap for sites that cannot update right away.

The third, CVE-2026-113501, lets a logged-in user with the Subscriber role or higher dismiss administrative notices that the plugin pins to the dashboard. On sites with open registration, anyone can get such an account. LiteSpeed notes that the flaw gives no access to site data and does not allow code execution or account takeover.

Older Versions and Mass Upgrades

Version statistics on wordpress.org show 9.39% of active installations on the 7.8 branch and 7.51% on 7.6, releases that predate all of these fixes. Based on the 7 million figure wordpress.org gives, that is roughly 1.2 million installations. These are outdated installations, not a count of sites that meet the three conditions behind CVE-2026-114190. The statistics group every 7.9 release into one figure, 69.6%, so they do not show how many sites already run 7.9.1 or 7.9.2.

LiteSpeed added 7.9.1 to the list of stable releases in its control panel plugins on September 4, and 7.9.2 on October 23. Hosts that use LiteSpeed’s plugin for cPanel and WHM can push the update themselves. Its command-line script, lscmctl, can upgrade LiteSpeed Cache on every discovered WordPress installation to a version the host sets as active, skipping installations an administrator has flagged. It can also broadcast a notice to all of those dashboards.