CVE-2026-113501: CWE-862 Missing Authorization in LiteSpeed Cache

The LiteSpeed Cache WordPress plugin prior to version 7.9.2 does not perform proper capability checks on its admin-notice dismissal handler. Additionally, the nonce used for this action is not bound to the specific notice being dismissed. As a result, in certain site configurations, a low-privileged authenticated user such as a Subscriber can dismiss administrative notices that the plugin marks as non-dismissible. This includes critical warnings, for example, about sensitive files that may be publicly accessible, potentially reducing the visibility of important security alerts to administrators.

Low-privileged authenticated users can dismiss important administrative notices that are intended to remain visible, including warnings about sensitive files being publicly accessible. This could lead to administrators missing critical security alerts, potentially increasing the risk of unnoticed security issues. However, this vulnerability does not directly allow privilege escalation or unauthorized access beyond dismissing notices.

Upgrade the LiteSpeed Cache WordPress plugin to version 7.9.2 or later, where this authorization issue has been fixed. Until the update is applied, administrators should be aware that low-privileged users may dismiss important notices and should verify critical security warnings manually.