{"id":"CVE-2026-90960","kind":"vulnerability","aliases":["CVE-2026-90960"],"related":[],"title":"WordPress Seraphinite Accelerator plugin exposes user records through cache files","description":"The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.","summary":"The Seraphinite Accelerator WordPress plugin writes user records into predictable gzip cache files under wp-content. An unauthenticated attacker who triggers caching and then downloads the file can read user logins, emails and password hashes.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","seraphinite-accelerator","wordpress"],"not_affected_if":["newer-version","object-cache-disabled","plugin-not-installed"],"how_to_check":"- Check whether the plugin is installed and its version is `2.29.24` or lower in the WordPress plugin list\n- Check whether the Object Cache feature is enabled in the plugin settings\n- Look for files under `wp-content/cache/seraphinite-accelerator/oc/g/users/` on the web server","fix":null,"status":"open","published_at":"2026-10-31T07:16:37+00:00","first_seen_at":"2026-10-31T07:34:08+00:00","triaged_at":"2026-10-31T07:34:47+00:00","updated_at":"2026-10-31T07:34:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-31T07:34:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Seraphinite Accelerator plugin exposes user records through cache files","impact":"medium","summary":"The Seraphinite Accelerator WordPress plugin writes user records into predictable gzip cache files under wp-content. An unauthenticated attacker who triggers caching and then downloads the file can read user logins, emails and password hashes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","seraphinite-accelerator","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"user logins, emails and password hashes readable by anyone","analyst_note":"Confirm the fixed version and the vendor advisory; the sources give no fixed version.","how_to_check":"- Check whether the plugin is installed and its version is `2.29.24` or lower in the WordPress plugin list\n- Check whether the Object Cache feature is enabled in the plugin settings\n- Look for files under `wp-content/cache/seraphinite-accelerator/oc/g/users/` on the web server","plain_action":"","needs_analyst":true,"not_affected_if":["object-cache-disabled","plugin-not-installed","newer-version"],"who_is_affected":"Sites running the Seraphinite Accelerator WordPress plugin up to and including 2.29.24 with its Object Cache feature turned on. The cache directory must be web-accessible, and an attacker must be able to trigger caching of a user record, for example through an unauthenticated REST request. Sites without the plugin or with Object Cache disabled are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4300,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-90960':13A,16A '/cache/seraphinite-accelerator/oc/g/users/g':124C '2.29.24':80C 'acceler':3A,23B,27B,63C 'activ':111C 'api':158C 'attack':44B,93C,143C 'cach':9A,36B,47B,85C,118C,136C,147C,164C 'complet':96C 'content':41B,123C 'cve':11A,14A 'dat.gz':125C 'download':50B 'e.g':153C 'email':57B,105C 'enabl':139C 'exploit':130C 'expos':5A 'exposur':72C 'extract':95C 'featur':137C 'file':10A,37B,52B,119C,165C 'first':145C 'getfilepath':86C 'gzip':35B,116C 'gzip-seri':115C 'hash':60B,106C 'host':20B 'includ':79C,100C 'inform':71C 'key':112C 'login':56B,103C 'make':88C 'object':84C,135C 'packag':17B 'pass':108C 'password':59B 'plaintext':101C 'plugin':4A,29B,64C,133C 'possibl':90C 'predict':34B,114C 'read':54B 'record':7A,32B,99C,152C 'request':159C 'requir':141C 'rest':157C 'result':163C 'retriev':161C 'self':19B 'self-host':18B 'sensit':70C 'seraphinit':2A,22B,26B,62C 'seraphinite-acceler':21B 'serial':117C 'target':150C 'trigger':46B,146C 'unauthent':43B,92C,156C 'user':6A,31B,55B,98C,102C,104C,107C,110C,151C 'version':75C 'via':81C,154C 'vulner':68C,127C 'wordpress':1A,24B,28B,66C,97C 'wp':40B,83C,122C 'wp-content':39B,121C 'write':30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Seraphinite Accelerator WordPress plugin up to and including 2.29.24 with its Object Cache feature turned on. The cache directory must be web-accessible, and an attacker must be able to trigger caching of a user record, for example through an unauthenticated REST request. Sites without the plugin or with Object Cache disabled are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90960","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90960","severity":null,"published_at":"2026-10-31T07:16:37+00:00","modified_at":"2026-10-31T07:16:37+00:00","first_seen_at":"2026-10-31T07:34:08+00:00","fetched_at":"2026-10-31T07:34:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}