CVE-2026-87828
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions. Authenticated users such as subscribers can write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
Risk Assessment
The entire WordPress admin panel becomes inaccessible, preventing site management and potentially requiring database-level intervention. The attack is easy to perform by any low-privileged authenticated user.
Recommendation
Update the Seraphinite Accelerator plugin to version 2.29.24 or later. Restrict the ability to register low-privileged accounts to the necessary minimum.
Other vulnerabilities in Seraphinite Accelerator
See all- CVE-2026-90960Medium
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 2.29.24 via WP_Object_Cache::_getFilePath. Unauthenticated attackers can extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
- CVE-2026-17532Medium
The Seraphinite Accelerator plugin for WordPress up to version 2.29.15 is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter. The CacheExtractPreparePageParams() function uses loose comparison (!=) for HMAC verification, allowing bypass, and insufficient output escaping in _CbContentFinishSkip() enables script injection. The attack requires user interaction, such as clicking a crafted link.
Original NVD description (English source)
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS