Live › vulnerability › CVE-2026-90960
The Seraphinite Accelerator WordPress plugin writes user records into predictable gzip cache files under wp-content. An unauthenticated attacker who triggers caching and then downloads the file can read user logins, emails and password hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the Seraphinite Accelerator WordPress plugin up to and including 2.29.24 with its Object Cache feature turned on. The cache directory must be web-accessible, and an attacker must be able to trigger caching of a user record, for example through an unauthenticated REST request. Sites without the plugin or with Object Cache disabled are not affected.
No product ranges from the sources yet.
2.29.24 or lower in the WordPress plugin listwp-content/cache/seraphinite-accelerator/oc/g/users/ on the web serverNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
This page as .md · .json · in your agent: get_signal("CVE-2026-90960")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.