Seraphinite Accelerator vulnerabilities

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 2.29.24 via WP_Object_Cache::_getFilePath. Unauthenticated attackers can extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions. Authenticated users such as subscribers can write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).

The Seraphinite Accelerator plugin for WordPress up to version 2.29.15 is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter. The CacheExtractPreparePageParams() function uses loose comparison (!=) for HMAC verification, allowing bypass, and insufficient output escaping in _CbContentFinishSkip() enables script injection. The attack requires user interaction, such as clicking a crafted link.