Sep 17, 2026
0 new incidents, 1 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Updated
- LivePatched
LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389)
LiteSpeed Cache for WordPress, a plugin with more than 7 million active installs, cached WooCommerce Store API cart and checkout responses as public objects in all versions up to 7.9.1. With the default Cache REST API setting on, a shopper’s personalized /wc/store/v1/cart or /wc/store/v1/checkout response could be served to any later visitor without cookies or a token. Per Wordfence, that exposes the shopper’s billing and shipping details (name, company, address, email, phone), cart contents and totals, their live Cart-Token session JWT and nonce (enough to hijack the cart or checkout session), and the order_key on checkout. Only sites running WooCommerce with cart or checkout in use are affected. Wordfence reported it to LiteSpeed on Sept 17, LiteSpeed fixed it in 7.9.2 on Oct 19, and the CVE was published on Nov 4. Wordfence rates it CVSS 8.2 (high). No exploitation has been reported.
LiteSpeed Cache for WordPressSince Nov 4, 2026
