TI-2026-85340 Aliases CVE-2026-93389 GHSA-3925-rqgx-v77p

Cache exposure in LiteSpeed Cache leaks WooCommerce shopper data

MEDIUM 41CWE-200Published 2026-11-05 · Updated 2026-11-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

The LiteSpeed Cache plugin for WordPress, up to and including 7.9.1, caches WooCommerce Store API cart and checkout responses as public objects without varying them on the Cart-Token or session. An unauthenticated remote attacker can read another shopper's billing and shipping details, cart contents and totals, and the live Cart-Token session token, which enables session hijack. The flaw is classified as CWE-200.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0023 13th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
litespeedtech	LiteSpeed Cache	up to 7.9.1	—	No fix listed	CNA

LiteSpeed Cache Vendorlitespeedtech Affected up to 7.9.1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:litespeedtech:litespeed_cache::::::::	—	—	litespeedtech

cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:*:*:* Versions — — ·litespeedtech

Remediation

The sources list no fixed version for LiteSpeed Cache.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

2026-11-05 Threatist record created from CVE-2026-93389
2026-11-05 Alias added: GHSA-3925-rqgx-v77p
2026-11-05 CISA SSVC decision points changed
2026-11-05 Priority changed: MEDIUM → LOW
2026-11-06 Priority changed: LOW → MEDIUM

References

Other 2

TI-2026-35606 LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to… KEVCVSS 4.0CRITICAL 10.0
TI-2026-39296 LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before… KEVCVSS 3.1HIGH 8.5
TI-2024-29589 WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability CVSS 3.1CRITICAL 9.8
TI-2024-18601 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
TI-2022-00030 Authenticated Remote Code Execution in OpenLiteSpeed Web Server CVSS 3.1HIGH 8.8
TI-2026-83023 Client certificate bypass over HTTP/3 in OpenLiteSpeed CVSS 4.0HIGH 8.2

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences