LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389)

LiteSpeed Cache for WordPress, a plugin with more than 7 million active installs, cached WooCommerce Store API cart and checkout responses as public objects in all versions up to 7.9.1. With the default Cache REST API setting on, a shopper’s personalized /wc/store/v1/cart or /wc/store/v1/checkout response could be served to any later visitor without cookies or a token. Per Wordfence, that exposes the shopper’s billing and shipping details (name, company, address, email, phone), cart contents and totals, their live Cart-Token session JWT and nonce (enough to hijack the cart or checkout session), and the order_key on checkout. Only sites running WooCommerce with cart or checkout in use are affected. Wordfence reported it to LiteSpeed on Sept 17, LiteSpeed fixed it in 7.9.2 on Oct 19, and the CVE was published on Nov 4. Wordfence rates it CVSS 8.2 (high). No exploitation has been reported.

Why this severity: Unauthenticated leak of shopper PII and cart session tokens in the default configuration; Wordfence CVSS 3.1 8.2 (high), Patchstack 7.5; no exploitation reported

Started

Nov 4, 2026

CVE

CVE-2026-93389

• WordPress
• #Litespeed
• #Litespeed Cache
• #Woocommerce
• #Wordpress Plugin
• #Information Disclosure
• #Session Hijack