CVE-2026-104006 in SpeedyCache Plugin
Summary
by MITRE • 10/10/2026
The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in SpeedyCache versions up to 1.4.2 represents a critical failure in session-aware caching logic within WordPress environments. This flaw allows for sensitive information exposure, specifically targeting personally identifiable information such as the full names and email addresses of users who have previously commented on public posts. The root cause lies in an asymmetry between how cached pages are served to visitors versus how they are generated and stored by the server. While the read-side handler located in advanced-cache.php correctly implements a check for comment_author_* cookies to bypass caching when such session identifiers are present, this protective mechanism is entirely absent from the write path where cache entries are created. This architectural oversight means that if an unauthenticated attacker requests a public URL after a legitimate user has left a comment, the server may generate and store a cached version of that page containing the victim's pre-filled form data without any indication to the system that this content is session-specific.
From a technical perspective, this vulnerability exploits the stateless nature of HTTP combined with aggressive caching strategies designed for performance optimization. When a user submits a comment on a WordPress site using SpeedyCache, their name and email address are often persisted in the form fields as convenience features to streamline future interactions. Under normal circumstances, subsequent requests by that same user would trigger the cookie-based bypass logic, ensuring they see fresh or personalized content. However, because the cache generation process does not account for these cookies during the write phase, a static copy of the page containing sensitive data is saved in the global cache store. Any other unauthenticated attacker who subsequently accesses the same URL will receive this cached response directly from the server without triggering any dynamic processing that would reveal the presence of user-specific data. This results in the leakage of private information to unintended recipients through standard web requests, requiring no authentication or complex exploitation techniques beyond a simple HTTP GET request.
The operational impact of this vulnerability is significant for organizations relying on WordPress for public-facing content and community engagement. The exposure of email addresses can facilitate targeted phishing campaigns, spamming, or social engineering attacks against the affected users. Furthermore, the disclosure of full names contributes to identity profiling activities that may be leveraged in broader reconnaissance efforts by malicious actors. Since the attack vector is unauthenticated and relies on basic web traffic patterns, it poses a persistent risk to any site utilizing this plugin version where user comments are enabled and caching is active. The invisibility of the cache poisoning to the victim commenter means there is no immediate feedback loop for users or administrators to detect that their data has been exposed via cached responses, allowing the issue to persist until the cache is manually cleared or expires naturally.
This vulnerability aligns with CWE-200, which classifies information exposure as a category of security weaknesses where sensitive information is disclosed to unauthorized actors due to improper handling by software components. In terms of offensive cyber operations and threat modeling, this behavior corresponds to ATT&CK technique T1530, Data from Cloud Storage Objects, although in this context it manifests through local server-side caching mechanisms rather than cloud storage buckets. The attack pattern resembles a cache poisoning scenario where the attacker manipulates the state or expectation of the system to store sensitive data that is then served incorrectly. To mitigate this risk, administrators must immediately update SpeedyCache to version 1.4.3 or later, which addresses the asymmetry in caching logic by ensuring that write operations also respect session boundaries and do not persist user-specific form data into global caches accessible to unauthenticated users. Additionally, implementing strict cache control headers for pages containing dynamic content can provide an additional layer of defense against such information leakage until all instances are patched.