LiteSpeed Cache (<= 7.9.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/litespeed-cache--7.9.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 06:28:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLiteSpeed Cache: Unauthenticated WooCommerce data disclosure (CVE-2026-93389)https://feed.craftedsignal.io/briefs/2026-11-litespeed-cache-disclosure/Thu, 05 Nov 2026 06:28:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-litespeed-cache-disclosure/The LiteSpeed Cache plugin for WordPress up to version 7.9.1 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive WooCommerce customer data and session tokens via improper public caching of REST API responses.The LiteSpeed Cache plugin for WordPress (versions 7.9.1 and earlier) is vulnerable to unauthenticated information disclosure. When the "Cache REST" feature is enabled - which is the default configuration - the plugin stores WooCommerce Store API responses for /wc/store/v1/cart and /wc/store/v1/checkout as public cache objects. The plugin fails to apply proper cache variation based on WooCommerce session cookies or Cart-Token headers. Consequently, a personalized response belonging to an authenticated shopper can be served to any subsequent, unauthenticated visitor. Attackers can leverage this to harvest PII (names, addresses, emails, phone numbers) and extract Cart-Token session JWTs and nonces, facilitating session hijacking.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized access to sensitive customer billing and shipping information, view cart contents, and perform session hijacking by stealing Cart-Token session JWTs and nonces.

Recommendation

  • Upgrade the LiteSpeed Cache plugin to a patched version beyond 7.9.1 immediately.
  • If patching is not immediately feasible, disable the "Cache REST" feature within the LiteSpeed Cache plugin settings to prevent sensitive Store API responses from being stored in the public cache.
  • Audit web server access logs for anomalous, high-frequency GET requests to /wc/store/v1/cart and /wc/store/v1/checkout endpoints originating from unrecognized IP addresses or missing expected session headers.
]]>highadvisoryweb-applicationwordpressinformation-disclosurecve-2026-93389