Sensitive Information Exposure in Seraphinite Accelerator Plugin for WordPress

CVE-2026-3058

What is CVE-2026-3058?

The Seraphinite Accelerator plugin for WordPress has a vulnerability that affects all versions up to and including 2.28.14. This weakness allows authenticated attackers, possessing Subscriber-level access or higher, to exploit the seraph_accel_api AJAX action with fn=GetData. The OnAdminApi_GetData() function lacks proper capability checks, enabling these attackers to expose sensitive operational data, including cache status, scheduled tasks, and details of external databases. This situation underscores the importance of rigorous access control and proper validation of user permissions in plugins.

References