Unauthenticated Data Exposure in LiteSpeed Cache for WordPress

CVE-2026-93389

What is CVE-2026-93389?

The LiteSpeed Cache plugin for WordPress is susceptible to an information disclosure vulnerability that exposes sensitive WooCommerce customer details. This issue allows unauthenticated attackers to access personal information, including billing and shipping data, from other customers. Specifically, when Cache REST is enabled, the plugin caches WooCommerce Store API responses without proper token validation, making responses from the cart and checkout endpoints publicly accessible. This flaw can lead to the exposure of critical user details such as names, addresses, email, and phone numbers, as well as the ability to hijack active cart sessions.

References