Description

Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-03T17:17:27.060Z",
  "pubdate": "2026-09-03T17:17:27.060Z",
  "executiveSummary": "This vulnerability is an Unauthenticated Server-Side Request Forgery (SSRF) affecting the LiteSpeed Cache plugin for WordPress in versions 7.9 and below.\nThe flaw allows remote, unauthenticated attackers to leverage the web server as a proxy to conduct arbitrary HTTP requests to internal or external resources.\nThis risk is critical as it bypasses network-level firewalls and access control lists (ACLs) that would otherwise restrict access to internal services, metadata endpoints, or private network assets.\nSuccessful exploitation permits an attacker to perform internal port scanning, interact with sensitive local services (e.g., databases, Redis, or cloud metadata services like AWS IMDS), and potentially exfiltrate sensitive configuration data or credentials stored within the internal environment.\nBecause the vulnerability is unauthenticated, no prior access or user interaction is required, significantly lowering the barrier for exploitation by malicious actors.\nOrganizations using affected versions of LiteSpeed Cache are at high risk of lateral movement and information disclosure if their internal infrastructure is exposed to the web server's request context.",
  "technicalDetails": "The root cause of this SSRF vulnerability lies in the improper validation of user-supplied input used within the plugin's internal request handling logic. Specifically, the component responsible for processing cache-related external calls fails to implement sufficient sanitization or allow-listing for destination URLs.\nThe attack flow begins when an unauthenticated attacker crafts a malicious HTTP request directed at specific endpoints managed by the LiteSpeed Cache plugin. By manipulating the parameters that govern external resource fetching—often intended for features like remote CSS/JS optimization or crawler tasks—the attacker forces the server to initiate an outbound request to an arbitrary URI.\nBecause the server initiates these requests, the traffic originates from the trusted internal IP address of the WordPress host. This effectively circumvents perimeter security boundaries. An attacker can use this functionality to interact with services bound to 'localhost' or '127.0.0.1' that are not meant to be accessed via the public internet.\nExploitation involves sending an HTTP request containing a crafted URL parameter. The vulnerable function processes this input without verifying whether the target hostname resolves to a safe, external domain or an unauthorized internal network component. This behavior mimics a proxy, where the LiteSpeed Cache plugin acts as a gateway for the attacker's commands.\nThe technical impact includes, but is not limited to: 1) Port Scanning: Probing internal network topology by analyzing response times or error codes returned by the plugin; 2) Metadata Exfiltration: If the WordPress instance is hosted on cloud infrastructure, an attacker can access the instance metadata service (e.g., 169.254.169.254) to retrieve IAM role credentials, instance identity documents, or security group information; 3) Internal Service Exploitation: Sending arbitrary GET requests to internal APIs or administrative dashboards that rely on IP-based authentication; 4) Blind SSRF: If the target does not return direct feedback, attackers may use out-of-band (OOB) techniques by targeting an external server they control to confirm the vulnerability's existence and capture request headers.\nThis vulnerability persists across all versions of LiteSpeed Cache <= 7.9, as these versions lack the necessary input validation checks required to prevent unauthorized resource requests."
}