CVE-2026-104006
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The SpeedyCache plugin for WordPress up to version 1.4.2 is vulnerable to sensitive information exposure via the 'comment_author_*' parameter. Unauthenticated attackers can extract full names and email addresses of commenters, which are pre-filled in forms and persisted in cached pages.
Risk Assessment
Attackers can obtain personal data of commenters, potentially leading to privacy breaches and use of this information for phishing or other attacks.
Recommendation
Update the SpeedyCache plugin to the latest version. Consider disabling caching for pages with comment forms.
Other vulnerabilities in SpeedyCache
Original NVD description (English source)
The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS