Security Update for LSCWP

We have a security update for LiteSpeed Cache for WordPress. Back in August, we were made aware of a vulnerability in the LiteSpeed Cache for WordPress plugin. We patched it in v7.9.1.

To protect your WordPress sites, please update to the latest version of the LSCache plugin immediately.

This Sensitive Data Exposure vulnerability, reported by the Patchstack team, has been assigned CVE-2026-114190.

Impact

This vulnerability affects sites with the following configuration:

• REST API caching is enabled (on by default)
• The site uses plain permalinks (also on by default)
• A legitimate cookieless integration, such as a mobile app, headless front end, or backup service authenticating via an application password, makes admin-level REST API calls

With these settings in place, an unauthenticated attacker may retrieve sensitive data that normally requires administrator access

The exposure persists for the duration of the configured REST cache lifetime (seven days by default) and requires a manual Purge All from the WordPress dashboard to clear the cached entry. Cron-based purge is not effective in this scenario.

Actions

We recommend that every site upgrade the plugin to patch this vulnerability. The current version as of this writing is v7.9.2.

Timeline

• August 17, 2026: Patchstack alerted us to the issue.
• September 1, 2026: We patched the issue and released v7.9.1 to the WordPress repository

Conclusion

We thank Patchstack for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.