{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389) · updates",
  "home_page_url": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389",
  "feed_url": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389/feed.json",
  "description": "LiteSpeed Cache for WordPress, a plugin with more than 7 million active installs, cached WooCommerce Store API cart and checkout responses as public objects in all versions up to 7.9.1. With the default Cache REST API setting on, a shopper’s personalized /wc/store/v1/cart or /wc/store/v1/checkout response could be served to any later visitor without cookies or a token. Per Wordfence, that exposes the shopper’s billing and shipping details (name, company, address, email, phone), cart contents and totals, their live Cart-Token session JWT and nonce (enough to hijack the cart or checkout session), and the order_key on checkout. Only sites running WooCommerce with cart or checkout in use are affected. Wordfence reported it to LiteSpeed on Sept 17, LiteSpeed fixed it in 7.9.2 on Oct 19, and the CVE was published on Nov 4. Wordfence rates it CVSS 8.2 (high). No exploitation has been reported.",
  "language": "en",
  "_pwn": {
    "slug": "litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389/feed.xml",
    "llms": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389/llms.txt",
    "json": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389#2026-11-04-c4ee960c",
      "url": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389#2026-11-04-c4ee960c",
      "title": "LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389): Wordfence publishes CVE-2026-93389 (CVSS 8.2): cached WooCommerce Store API cart and checkout responses leak another shopper’s billing and shipping details, cart contents, Cart-Token session JWT and order_key to unauthenticated visitors; LiteSpeed publishes a security update post urging everyone to update.",
      "content_text": "LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389): Wordfence publishes CVE-2026-93389 (CVSS 8.2): cached WooCommerce Store API cart and checkout responses leak another shopper’s billing and shipping details, cart contents, Cart-Token session JWT and order_key to unauthenticated visitors; LiteSpeed publishes a security update post urging everyone to update.\n\nSource: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-791-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cartcheckout-pii-cart-token-via-public-rest-caching",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-791-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cartcheckout-pii-cart-token-via-public-rest-caching",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389#2026-10-19-c949bf2f",
      "url": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389#2026-10-19-c949bf2f",
      "title": "LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389): LiteSpeed releases LiteSpeed Cache 7.9.2 with the fix to the WordPress plugin repository (added to its control-panel stable list on Oct 23).",
      "content_text": "LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389): LiteSpeed releases LiteSpeed Cache 7.9.2 with the fix to the WordPress plugin repository (added to its control-panel stable list on Oct 23).\n\nSource: https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/",
      "date_published": "2026-10-19T00:00:00.000Z",
      "external_url": "https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389#2026-09-17-615d46f0",
      "url": "https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389#2026-09-17-615d46f0",
      "title": "LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389): Wordfence reports the issue to LiteSpeed.",
      "content_text": "LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389): Wordfence reports the issue to LiteSpeed.\n\nSource: https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/",
      "date_published": "2026-09-17T00:00:00.000Z",
      "external_url": "https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/",
      "tags": [
        "high"
      ]
    }
  ]
}