CVE-2026-93389 in Cache Plugin
Summary
by MITRE • 11/05/2026
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in LiteSpeed Cache versions up to 7.9.1 represents a critical failure in cache key generation logic for dynamic e-commerce endpoints, specifically affecting WooCommerce Store API interactions when REST caching is enabled by default. The core technical flaw lies in the plugin's handling of GET requests directed at /wc/store/v1/cart and /wc/store/v1/checkout. Instead of generating unique cache keys that account for user-specific identifiers such as session cookies or Cart-Token headers, the system stores these responses as public objects accessible to all users regardless of their authentication state. This misconfiguration effectively transforms private, personalized data into publicly cached content within the server's memory and subsequent storage layers, creating a severe information disclosure pathway.
From an operational perspective, this flaw allows unauthenticated attackers to retrieve sensitive customer data simply by issuing HTTP GET requests to the affected endpoints. Because the cache does not vary based on the Cart-Token or WooCommerce session identifiers, any client without cookies or tokens can receive responses intended for authenticated shoppers who previously interacted with those pages. The exposed data includes personally identifiable information such as billing and shipping addresses, names, email addresses, phone numbers, company details, cart contents, totals, order keys, and critically, the live Cart-Token session JWTs and nonces. This exposure compromises not only customer privacy but also system integrity by facilitating further attacks through credential or token theft.
The security implications are severe, aligning with CWE-200: Information Exposure and CWE-524: Use of Cache for Sensitive Data in Authentication/Authorization Mechanisms. By exposing session tokens like the Cart-Token JWT, the vulnerability enables cart hijacking and checkout-session manipulation attacks as described in MITRE ATT&CK technique T1539: Steal Web Session Cookie. An attacker can capture a valid token from the cache response and use it to impersonate the original user, potentially completing purchases on their behalf or accessing restricted account information. This undermines the fundamental security model of web applications where session state must remain isolated per user context.
Mitigation strategies require immediate action by site administrators and plugin developers. The primary remediation is to upgrade LiteSpeed Cache to a version that corrects the cache key generation logic, ensuring that dynamic endpoints vary their cached responses based on unique user identifiers such as cookies or authorization headers. Until an update is applied, administrators should disable REST caching for WooCommerce endpoints via server configuration or plugin settings if possible. Additionally, implementing strict HTTP header controls like Vary: Cookie and Vary: Authorization can help ensure proper cache isolation at the reverse proxy level. Regular security audits of third-party WordPress plugins are essential to detect similar misconfigurations that compromise data confidentiality in e-commerce environments.