---
id: "CVE-2026-90960"
kind: "vulnerability"
aliases: ["CVE-2026-90960"]
title: "WordPress Seraphinite Accelerator plugin exposes user records through cache files"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "seraphinite-accelerator", "wordpress"]
not_affected_if: ["newer-version", "object-cache-disabled", "plugin-not-installed"]
published_at: "2026-10-31T07:16:37+00:00"
first_seen_at: "2026-10-31T07:34:08+00:00"
updated_at: "2026-10-31T07:34:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90960", "first_seen_at": "2026-10-31T07:34:08+00:00"}]
---

# WordPress Seraphinite Accelerator plugin exposes user records through cache files

The Seraphinite Accelerator WordPress plugin writes user records into predictable gzip cache files under wp-content. An unauthenticated attacker who triggers caching and then downloads the file can read user logins, emails and password hashes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the plugin is installed and its version is `2.29.24` or lower in the WordPress plugin list
- Check whether the Object Cache feature is enabled in the plugin settings
- Look for files under `wp-content/cache/seraphinite-accelerator/oc/g/users/` on the web server

## Timeline

- 2026-10-31T07:34:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90960

## From the sources

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_