# LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389) · pwn.watch > LiteSpeed Cache for WordPress, a plugin with more than 7 million active installs, cached WooCommerce Store API cart and checkout responses as public objects in all versions up to 7.9.1. With the default Cache REST API setting on, a shopper’s personalized /wc/store/v1/cart or /wc/store/v1/checkout response could be served to any later visitor without cookies or a token. Per Wordfence, that exposes the shopper’s billing and shipping details (name, company, address, email, phone), cart contents and totals, their live Cart-Token session JWT and nonce (enough to hijack the cart or checkout session), and the order_key on checkout. Only sites running WooCommerce with cart or checkout in use are affected. Wordfence reported it to LiteSpeed on Sept 17, LiteSpeed fixed it in 7.9.2 on Oct 19, and the CVE was published on Nov 4. Wordfence rates it CVSS 8.2 (high). No exploitation has been reported. Page: https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389 · generated 2026-11-05T14:39:04.572Z ## Status - Severity: high · status: live · patch: patched - Product: LiteSpeed Cache for WordPress - Started: 2026-11-04 - CVEs: CVE-2026-93389 - Affected: LiteSpeed Cache for WordPress 7.9.1 and earlier (with Cache REST API on and WooCommerce cart or checkout in use) - Fixed in: LiteSpeed Cache for WordPress 7.9.2 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389/feed.xml - JSON Feed: https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389.json - This file: https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389/llms.txt ## Updates (newest first) - 2026-11-04: Wordfence publishes CVE-2026-93389 (CVSS 8.2): cached WooCommerce Store API cart and checkout responses leak another shopper’s billing and shipping details, cart contents, Cart-Token session JWT and order_key to unauthenticated visitors; LiteSpeed publishes a security update post urging everyone to update. (https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-791-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cartcheckout-pii-cart-token-via-public-rest-caching) - 2026-10-19: LiteSpeed releases LiteSpeed Cache 7.9.2 with the fix to the WordPress plugin repository (added to its control-panel stable list on Oct 23). (https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/) - 2026-09-17: Wordfence reports the issue to LiteSpeed. (https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/) ## Fix brief # Security brief: LiteSpeed Cache serves WooCommerce shoppers’ cart and checkout data, including session tokens, to anyone (CVE-2026-93389) Source: https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389 · status: live · severity: high · updated Nov 5, 2026, 05:14 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is LiteSpeed Cache for WordPress, a plugin with more than 7 million active installs, cached WooCommerce Store API cart and checkout responses as public objects in all versions up to 7.9.1. With the default Cache REST API setting on, a shopper’s personalized /wc/store/v1/cart or /wc/store/v1/checkout response could be served to any later visitor without cookies or a token. Per Wordfence, that exposes the shopper’s billing and shipping details (name, company, address, email, phone), cart contents and totals, their live Cart-Token session JWT and nonce (enough to hijack the cart or checkout session), and the order_key on checkout. Only sites running WooCommerce with cart or checkout in use are affected. Wordfence reported it to LiteSpeed on Sept 17, LiteSpeed fixed it in 7.9.2 on Oct 19, and the CVE was published on Nov 4. Wordfence rates it CVSS 8.2 (high). No exploitation has been reported. Severity detail: Unauthenticated leak of shopper PII and cart session tokens in the default configuration; Wordfence CVSS 3.1 8.2 (high), Patchstack 7.5; no exploitation reported - Product: LiteSpeed Cache for WordPress - CVE / advisory ids: CVE-2026-93389 ## Affected versions - LiteSpeed Cache for WordPress 7.9.1 and earlier (with Cache REST API on and WooCommerce cart or checkout in use) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - LiteSpeed Cache for WordPress 7.9.2 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes On WordPress sites running WooCommerce, update the LiteSpeed Cache plugin to 7.9.2 or later (wp plugin update litespeed-cache), then purge all LiteSpeed caches so already-stored cart and checkout responses are removed. If you cannot update right away, turn off Cache > Cache > Cache REST API and purge the cache. ## Latest updates - Nov 4, 2026: Wordfence publishes CVE-2026-93389 (CVSS 8.2): cached WooCommerce Store API cart and checkout responses leak another shopper’s billing and shipping details, cart contents, Cart-Token session JWT and order_key to unauthenticated visitors; LiteSpeed publishes a security update post urging everyone to update. - Oct 19, 2026: LiteSpeed releases LiteSpeed Cache 7.9.2 with the fix to the WordPress plugin repository (added to its control-panel stable list on Oct 23). - Sep 17, 2026: Wordfence reports the issue to LiteSpeed. ## Advisories - [LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-791-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cartcheckout-pii-cart-token-via-public-rest-caching) (Wordfence) - [Security Update for LSCWP (CVE-2026-93389)](https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/) (LiteSpeed Technologies) - [WordPress LiteSpeed Cache Plugin <= 7.9.1 is vulnerable to Sensitive Data Exposure](https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-9-1-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cart-checkout-pii-cart-token-vulnerability) (Patchstack) --- Machine-readable: https://pwn.watch/i/litespeed-cache-woocommerce-cart-pii-leak-cve-2026-93389.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.