# CVE-2026-113501: LiteSpeed Cache WordPress plugin authorization bypass in admin notice dismissal

Source: https://junglewise.ai/threats/cve-2026-113501-the-litespeed-cache-wordpress-plugin-before-7-9-2-does-not  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-113501 · Severity: info · Published 2026-10-23

The LiteSpeed Cache WordPress plugin is a performance optimization tool for WordPress sites. A low-privileged user (Subscriber) can dismiss important administrative warnings that should only be dismissible by administrators, including alerts about publicly accessible sensitive files. This could allow attackers to hide security warnings and prevent site administrators from taking corrective action.

Technologies: [LiteSpeed Cache](https://junglewise.ai/threats/technologies/litespeed-cache-1). Vendors: [LiteSpeed](https://junglewise.ai/threats/vendors/litespeed).

## Quick answers

**Is CVE-2026-113501 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113501 being exploited in the wild.

**How severe is CVE-2026-113501?** Informational severity, published 23 October 2026.

**Which products and versions are affected?** LiteSpeed Cache before 7.9.2.

**Is there a fix for CVE-2026-113501?** Yes: fixed in 7.9.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113501 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-113501?** Check whether you run LiteSpeed Cache at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.9.2

## Technical details

The admin-notice dismissal handler in LiteSpeed Cache before 7.9.2 lacks both capability checks and proper nonce binding to specific notices, allowing authenticated low-privileged users to dismiss non-dismissible administrative notices. The vulnerability is exploitable via authenticated HTTP requests in certain site configurations. A fix is available in version 7.9.2.

## Affected products

- LiteSpeed Cache before 7.9.2

## Timeline

- 2026-10-21: disclosed
- 2026-10-23: advisory

## References

- [https://wpscan.com/vulnerability/a1f6a6c7-1d08-4d5c-ac57-bda5ff59737b/](https://wpscan.com/vulnerability/a1f6a6c7-1d08-4d5c-ac57-bda5ff59737b/)

## Related threats

- [LiteSpeed Cache WordPress plugin stored XSS in comment rewriting](https://junglewise.ai/threats/cve-2026-113499-the-litespeed-cache-wordpress-plugin-before-7-9-2-does-not)
- [LiteSpeed Cache reflected XSS via esi parameter](https://junglewise.ai/threats/cve-2026-76579-the-litespeed-cache-plugin-for-wordpress-is-vulnerable-to)