Critical LiteSpeed Plugin Vulnerability (CVSS 9.8) Allows Root Code Execution

A critical security vulnerability in the LiteSpeed Web Server plugin, rated as a maximum severity CVSS score of 9.8, has been disclosed to the public, enabling unauthenticated attackers to execute arbitrary code with root privileges on affected systems. The flaw, identified in the widely used LiteSpeed Web Server and its caching plugin, was reported by security researchers to the vendor on May 20, 2026, with a patch released just hours before the disclosure timeline expired on May 28.

The vulnerability affects versions of LiteSpeed Web Server prior to 6.7.1, including the LiteSpeed Cache plugin for WordPress, which powers over 30% of all websites globally. According to the vendor’s emergency advisory, the flaw stems from an improper input validation in the server’s HTTP request parsing module, allowing attackers to craft malicious payloads that bypass authentication checks entirely. The advisory explicitly states that exploitation does not require prior access to the target system, making it a zero-day risk for unpatched installations.

The disclosure follows a coordinated vulnerability disclosure process, with the vendor confirming that no known public exploits exist at the time of patch release. However, security researchers warn that the technical details of the flaw—including proof-of-concept code—were shared with select vendors and CERT teams prior to public disclosure, raising concerns about potential delayed exploitation. “This is one of the most severe web server vulnerabilities we’ve seen in years,” said a security analyst at a major European CERT, who requested anonymity. “The combination of root execution and the plugin’s ubiquity means this could become a widespread attack vector if not patched immediately.”

LiteSpeed Technologies, based in Dallas, Texas, has urged administrators to upgrade to version 6.7.1 or later and apply the accompanying security patches for all supported plugins. The company’s emergency response team has also published detailed mitigation steps for organizations unable to upgrade immediately, including disabling the LiteSpeed Cache plugin until a full patch can be applied. “We take these issues extremely seriously,” stated a spokesperson for LiteSpeed Technologies in an email to affected customers. “Our team worked around the clock to develop and validate the fix and we strongly recommend all users apply the update as soon as possible.”

The vulnerability’s disclosure coincides with a broader industry focus on web server security, as recent high-profile breaches have targeted similar infrastructure components. While LiteSpeed Technologies has not disclosed whether the flaw was discovered internally or reported by an external researcher, the company’s rapid response aligns with its history of proactive security measures, including its participation in the CVE program and regular security audits.

For organizations using LiteSpeed Web Server or the LiteSpeed Cache plugin, the vendor has provided a temporary workaround involving server configuration adjustments to mitigate the risk until the patch can be applied. However, security experts caution that these measures are not a substitute for the full update and should be treated as interim protection only. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is expected to issue a formal alert in the coming hours, urging critical infrastructure operators to prioritize patching.