LiteSpeed Cache for WordPress: CVE-2026-114190 vulnerability, update to v7.9.2

LiteSpeed Technologies has published a security advisory for LiteSpeed Cache for WordPress (LSCWP), the server-side caching plugin deployed on over 7 million active sites according to official WordPress.org data. The vulnerability, identified as CVE-2026-114190, is a sensitive data disclosure issue: hosting managers running LiteSpeed Web Server or OpenLiteSpeed should verify the installed version of the plugin.

What the vulnerability exposes

According to LiteSpeed's advisory, the vulnerability has been classified as significant and affects LiteSpeed Cache Plugin up to version 7.9. The CVE database catalogues it as CWE-201, with a CVSS 3.1 score of 5.9 (medium), network vector, high attack complexity, no privileges required, and high confidentiality impact.

The LiteSpeed source describes the at-risk configuration: REST API calls caching enabled (default option), plain permalinks (also default), and legitimate integrations without cookies — mobile apps, headless frontends or backup services — making REST API calls with administrator privileges via application password. Under these conditions an unauthenticated attacker can retrieve data that normally requires administrator access. The exposure remains valid for the entire configured cache duration for REST calls, seven days by default, and removal requires manual Purge All from the WordPress dashboard: cron purges are insufficient.

Timeline and version to install

LiteSpeed reports that Patchstack disclosed the issue on 17 August 2026 and the patch was released on 1 September 2026 with version 7.9.1. The current version at the time of the advisory publication is 7.9.2. The credited researcher for discovery is Ananda Dhakal of Patchstack, according to the CVE registry.

What to do

Hosting managers or WordPress site operators running LiteSpeed servers should check the plugin version from Dashboard → Plugins and update to at least 7.9.1, preferably to 7.9.2. Those keeping the plugin updated regularly, as LiteSpeed itself notes, need not take action: the patch has been included since September.

LiteSpeed Cache is a LiteSpeed Technologies product.