CVE-2026-90960
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 2.29.24 via WP_Object_Cache::_getFilePath. Unauthenticated attackers can extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
Risk Assessment
Potential exposure of user credentials and personal information, which could lead to account takeover. The risk applies to sites with the Object Cache feature enabled in the Seraphinite Accelerator plugin.
Recommendation
Update the Seraphinite Accelerator plugin to a version later than 2.29.24. If updating is not possible, consider disabling the Object Cache feature.
Other vulnerabilities in Seraphinite Accelerator
See all- CVE-2026-87828Medium
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions. Authenticated users such as subscribers can write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
- CVE-2026-17532Medium
The Seraphinite Accelerator plugin for WordPress up to version 2.29.15 is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter. The CacheExtractPreparePageParams() function uses loose comparison (!=) for HMAC verification, allowing bypass, and insufficient output escaping in _CbContentFinishSkip() enables script injection. The attack requires user interaction, such as clicking a crafted link.
Original NVD description (English source)
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS