CVE-2026-3058 in Seraphinite Accelerator Plugin
Summary
by MITRE • 03/04/2026
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the `seraph_accel_api` AJAX action with `fn=GetData`. This is due to the `OnAdminApi_GetData()` function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled task information, and external database state.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/31/2026
The Seraphinite Accelerator plugin for WordPress presents a critical security vulnerability classified as CVE-2026-3058, affecting all versions through 2.28.14. This vulnerability stems from insufficient access control mechanisms within the plugin's administrative API endpoint, specifically the `seraph_accel_api` AJAX action with the `fn=GetData` parameter. The flaw resides in the `OnAdminApi_GetData()` function which fails to implement proper capability verification checks, creating an unauthorized data exposure condition that compromises the integrity of the WordPress installation.
The technical implementation of this vulnerability allows authenticated attackers who possess Subscriber-level privileges or higher to exploit the exposed API endpoint and extract sensitive operational data from the WordPress environment. The exposed information includes detailed cache status information, scheduled task configurations, and external database connection states that should remain restricted to privileged administrators only. This represents a significant information disclosure vulnerability that violates fundamental security principles of least privilege and access control enforcement.
From an operational impact perspective, this vulnerability creates substantial risk for WordPress installations using the affected plugin, as it enables attackers to gather intelligence about the system's internal operations and infrastructure. The leaked cache status information could aid in crafting more sophisticated attacks targeting performance optimization features, while scheduled task details might reveal system maintenance windows or operational patterns. Database state information exposure could provide attackers with insights into database structure and connectivity, potentially facilitating further exploitation attempts.
The vulnerability aligns with CWE-284 Access Control Issues, specifically addressing inadequate access control mechanisms in web applications. It also corresponds to ATT&CK technique T1213 Data from Information Repositories, as it enables unauthorized access to operational data repositories within the WordPress environment. The lack of capability checks in the API endpoint represents a fundamental security oversight that violates the principle of proper authentication and authorization enforcement in web application development.
Organizations should immediately implement mitigations including updating to the latest plugin version where this vulnerability has been addressed, implementing additional access control measures through custom code or security plugins, and conducting thorough security audits of all installed WordPress plugins. Network segmentation and monitoring solutions should be employed to detect unauthorized API access attempts, while regular security assessments should verify that all administrative endpoints properly enforce access controls. Administrators should also consider implementing web application firewalls to block suspicious API requests and maintain detailed logging of all administrative API interactions for forensic analysis purposes.