Read the docs
TI-2026-70243 Aliases CVE-2026-104006GHSA-fvr3-4rq4-9pc2

Cache poisoning exposes commenter data in SpeedyCache WordPress plugin

Priority LOW 17CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The SpeedyCache plugin for WordPress in all versions up to and including 1.4.2 can store a page pre-filled with a returning commenter's full name and email address as the site-wide cached page. The cache write path skips the comment_author_* cookie check that the read path applies, which exposes sensitive information (CWE-524). An unauthenticated remote attacker with no cookies can fetch the stored commenter data by requesting the same public URL.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
softaculousSpeedyCache – Cache, Optimization, Performanceup to 1.4.2—No fix listedCNA
  • SpeedyCache – Cache, Optimization, Performance Vendorsoftaculous Affected up to 1.4.2 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for SpeedyCache (Cache, Optimization, Performance).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-104006
  2. 2026-10-10 Alias added: GHSA-fvr3-4rq4-9pc2
  3. 2026-10-11 CISA SSVC decision points changed

References

Other 7

  • TI-2026-31743 Softaculous Virtualizor OS Command Injection via Billing Module Handler CVSS 4.0CRITICAL 9.3
  • TI-2024-01104 AMPPS Encryption Passphrase denial of service CVSS 3.1HIGH 7.5
  • TI-2024-08042 Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection CVSS 3.1CRITICAL 9.1
  • TI-2024-16212 Softaculous Webuzo Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2026-31745 Softaculous Virtualizor Authorization Bypass via Billing Module Handler CVSS 4.0HIGH 8.7
  • TI-2024-07404 FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload CVSS 3.1HIGH 8.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences