LiteSpeed Cache: Unauthenticated WooCommerce data disclosure (CVE-2026-93389)

The LiteSpeed Cache plugin for WordPress (versions 7.9.1 and earlier) is vulnerable to unauthenticated information disclosure. When the "Cache REST" feature is enabled - which is the default configuration - the plugin stores WooCommerce Store API responses for /wc/store/v1/cart and /wc/store/v1/checkout as public cache objects. The plugin fails to apply proper cache variation based on WooCommerce session cookies or Cart-Token headers. Consequently, a personalized response belonging to an authenticated shopper can be served to any subsequent, unauthenticated visitor. Attackers can leverage this to harvest PII (names, addresses, emails, phone numbers) and extract Cart-Token session JWTs and nonces, facilitating session hijacking.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized access to sensitive customer billing and shipping information, view cart contents, and perform session hijacking by stealing Cart-Token session JWTs and nonces.

Recommendation

• Upgrade the LiteSpeed Cache plugin to a patched version beyond 7.9.1 immediately.
• If patching is not immediately feasible, disable the "Cache REST" feature within the LiteSpeed Cache plugin settings to prevent sensitive Store API responses from being stored in the public cache.
• Audit web server access logs for anomalous, high-frequency GET requests to /wc/store/v1/cart and /wc/store/v1/checkout endpoints originating from unrecognized IP addresses or missing expected session headers.