Sensitive Information Exposure in Seraphinite Accelerator Plugin for WordPress

CVE-2026-90960

What is CVE-2026-90960?

The Seraphinite Accelerator plugin for WordPress is susceptible to a sensitive information exposure vulnerability. This issue allows unauthenticated attackers to gain access to sensitive user information, such as user login details, email addresses, hashed passwords, and activation keys. The vulnerability occurs in all versions up to 2.29.24 and is exploited through predictable gzip-serialized cache files located at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. Effective exploitation requires the Object Cache feature of the plugin to be enabled and necessitates triggering the caching of the targeted user record, typically via an unauthenticated REST API request, prior to retrieval of the cache file.

References