The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,…
CVE-2026-90960
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WPObjectCache::getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext userlogin, useremail, hashed userpass, and useractivationkey — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/ .dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
Assessment
- CVSS
- 5.3 (v3.1)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 31 October 2026
- Last updated
- 31 October 2026
- Affected
- seraphinitesoft
- Assigner
- Wordfence
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
At the source
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/71b64440-6a31-40e4-9f38-93eba8858a2c?source=cve
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/tags/2.29.24/cache_obj.php#L257
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/tags/2.29.24/cache_obj.php#L319
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/tags/2.29.24/cache_obj.php#L191
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/tags/2.29.24/common.php#L1873
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/tags/2.29.24/common.php#L2828
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/tags/2.29.24/oper.php#L1595
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/tags/2.29.24/oper.php#L2058
- https://plugins.trac.wordpress.org/changeset/3701630/seraphinite-accelerator/trunk/cache_obj.php
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-90960