LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Exposure via Preset Backup Files
- ID
- WPSEC-2026-1393
- Plugin
- LiteSpeed Cache (litespeed-cache)
- Affected
- from 5.3 before 7.9.2
- Remediation
- Update to 7.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-538
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-21
- Attack surface
- LiteSpeed Cache on WPSec AttackSurface
- Fix released
- Published
Description
The LiteSpeed Cache plugin for WordPress is vulnerable to Sensitive Information Exposure via preset backup files in all versions from 5.3 up to, and including, 7.9.1. This is due to automatic preset backups being written as plain .data files, with predictable names built from a timestamp and the preset name, into the web-accessible wp-content/litespeed/auto-backup directory. Versions 7.9 and 7.9.1 block access to that directory only through an .htaccess file, which servers such as nginx do not apply. This makes it possible for unauthenticated attackers to download the plugin's full exported settings after an administrator has applied a preset. These settings can include the QUIC.cloud API key, object cache and CDN credentials, crawler cookies and the plugin's internal security hash. Version 7.9.2 writes new backups to protected PHP files without these secrets, but it does not remove existing backups. After updating, administrators should delete the wp-content/litespeed/auto-backup directory and rotate any credentials it held.
References
- https://wpsec.com/vuln/WPSEC-2026-1393/
- https://plugins.svn.wordpress.org/litespeed-cache/tags/7.9.2/
- https://wordpress.org/plugins/litespeed-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS