The LiteSpeed Cache WordPress plugin fails to verify that a user has the appropriate capability before handling the dismissal of administrative notices, and the nonce used in the request is not tied to the specific notice being dismissed. Consequently, any authenticated account with a subscriber role can remove notices that the plugin designates as non-dismissible, including warnings that sensitive files may be publicly exposed. By silencing such warnings, a malicious or misinformed user can proceed with actions that might otherwise be flagged, potentially facilitating further exploitation of insecure files or content.

LiteSpeed Cache WordPress plugin versions earlier than 7.9.2 are affected. No other vendors or products are explicitly listed.

The CVSS score of 3.1 indicates low severity. The exploit requires an authenticated subscriber account, which is a low‑privilege role within WordPress. Because the attack vector is local to the site’s administrative interface and no remote mechanisms are described, the risk is moderate. The EPSS score of 0.00143% indicates an extremely low exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. However, any user with subscriber access can deliberately dismiss the warning, resulting in the loss of visibility of potentially dangerous file exposures.