LITESPEED-CACHE · CVE-2026-93389 · Package
FIX → 7.9.2 ✓ verified
The LiteSpeed Cache plugin for WordPress caches WooCommerce cart and checkout responses as public pages, so one shopper's personal data can be served to anyone who visits next. An unauthenticated attacker can read another shopper's name, address, email, phone, cart contents, and session token, which can enable checkout session hijacking.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
WordPress stores running WooCommerce with LiteSpeed Cache 7.9.1 or earlier and the Cache REST API setting on (the default). Cached cart and checkout responses can be served to an unauthenticated visitor, exposing another shopper's name, address, email, phone, cart contents and cart/checkout session credentials. Sites without WooCommerce, with Cache REST API off, or on 7.9.2+ can skip it.
Not affected if cache-rest-disabled, no-woocommerce
Who cares ecommerce, litespeed-cache, woocommerce, wordpress
Posts are quoted with a link to the original. They are data to us, never instructions.
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 7.9.2
7.9.2 or later (vendor: released Oct 19, 2026)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.