{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/litespeed-cache--7.9.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-93389"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LiteSpeed Cache (\u003c= 7.9.1)"],"_cs_severities":["high"],"_cs_tags":["web-application","wordpress","information-disclosure","cve-2026-93389"],"_cs_type":"advisory","_cs_vendors":["LiteSpeed"],"content_html":"\u003cp\u003eThe LiteSpeed Cache plugin for WordPress (versions 7.9.1 and earlier) is vulnerable to unauthenticated information disclosure. When the \u0026quot;Cache REST\u0026quot; feature is enabled - which is the default configuration - the plugin stores WooCommerce Store API responses for \u003ccode\u003e/wc/store/v1/cart\u003c/code\u003e and \u003ccode\u003e/wc/store/v1/checkout\u003c/code\u003e as public cache objects. The plugin fails to apply proper cache variation based on WooCommerce session cookies or Cart-Token headers. Consequently, a personalized response belonging to an authenticated shopper can be served to any subsequent, unauthenticated visitor. Attackers can leverage this to harvest PII (names, addresses, emails, phone numbers) and extract Cart-Token session JWTs and nonces, facilitating session hijacking.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to gain unauthorized access to sensitive customer billing and shipping information, view cart contents, and perform session hijacking by stealing Cart-Token session JWTs and nonces.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the LiteSpeed Cache plugin to a patched version beyond 7.9.1 immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, disable the \u0026quot;Cache REST\u0026quot; feature within the LiteSpeed Cache plugin settings to prevent sensitive Store API responses from being stored in the public cache.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for anomalous, high-frequency GET requests to \u003ccode\u003e/wc/store/v1/cart\u003c/code\u003e and \u003ccode\u003e/wc/store/v1/checkout\u003c/code\u003e endpoints originating from unrecognized IP addresses or missing expected session headers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T06:28:37Z","date_published":"2026-11-05T06:28:37Z","id":"https://feed.craftedsignal.io/briefs/2026-11-litespeed-cache-disclosure/","summary":"The LiteSpeed Cache plugin for WordPress up to version 7.9.1 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive WooCommerce customer data and session tokens via improper public caching of REST API responses.","title":"LiteSpeed Cache: Unauthenticated WooCommerce data disclosure (CVE-2026-93389)","url":"https://feed.craftedsignal.io/briefs/2026-11-litespeed-cache-disclosure/"}],"language":"en","title":"CraftedSignal Threat Feed - LiteSpeed Cache (\u003c= 7.9.1)","version":"https://jsonfeed.org/version/1.1"}