WordPress Plugin Vulnerabilities

LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal

Description

The plugin does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the plugin marks as non-dismissible, including a warning that sensitive files may be publicly accessible.

Proof of Concept

Affects Plugins

Fixed in 7.9.2

References

Classification

Type
NO AUTHORISATION
CWE
CVSS

Miscellaneous

Original Researcher
Karthik Ramakrishnan
Submitter
Karthik Ramakrishnan
Verified
Yes

Timeline

Publicly Published
2026-10-21 (about 2 days ago)
Added
2026-10-21 (about 1 day ago)
Last Updated
2026-10-21 (about 1 day ago)

Other