This vulnerability allows an unauthenticated attacker to trigger the WordPress LiteSpeed Cache plugin to issue HTTP requests to arbitrary URLs, potentially exposing internal networks or sensitive data. The weakness is categorized as CWE-918, which enables attackers to access or interact with resources that should be protected. While the exploitation does not grant direct code execution, the ability to reach internal or restricted services could facilitate further attacks such as data exfiltration or credential theft.

WordPress sites running the LiteSpeed Cache plugin, all versions equal to or older than 7.9 are affected. Updating to version 7.9.1 or newer removes the flaw.

The CVSS score of 7.2 classifies the vulnerability as high severity, and although no EPSS score is available, the lack of a KEV listing suggests limited current exploitation data. Inferred from the description, the attack vector is remote, requiring no authentication and no special privileges; the attacker simply requests a page that triggers the plugin’s request logic. Impact is limited to availability and confidentiality of internal resources accessed via SSRF.