{"id":"CVE-2026-93389","kind":"vulnerability","aliases":["CVE-2026-93389"],"related":[],"title":"LiteSpeed Cache WordPress plugin leaks other shoppers' WooCommerce cart and checkout data","description":"The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.","summary":"The LiteSpeed Cache plugin for WordPress caches WooCommerce cart and checkout responses as public pages, so one shopper's personal data can be served to anyone who visits next. An unauthenticated attacker can read another shopper's name, address, email, phone, cart contents, and session token, which can enable checkout session hijacking.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"litespeed-cache","fixed":["7.9.2"],"affected":"<= 7.9.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["ecommerce","litespeed-cache","package","woocommerce","wordpress"],"not_affected_if":["cache-rest-disabled","no-woocommerce"],"how_to_check":"- WordPress admin > Plugins: LiteSpeed Cache 7.9.1 or earlier is affected; 7.9.2+ is patched.\n- Only exposed if all are true (per LiteSpeed): LiteSpeed Cache > Cache > Cache REST API is ON (the default), WooCommerce is installed and active with cart/checkout in use, and at least one shopper has used the cart or checkout.\n- Also check: if you cannot update yet, turning Cache REST API off is a reasonable stopgap (not stated by the vendor); purge the LiteSpeed cache after updating so previously cached cart/checkout responses are not served.","fix":"Update LiteSpeed Cache to 7.9.2 or later (vendor: released Oct 19, 2026). Vendor names no other setting change.","status":"open","published_at":"2026-11-05T05:18:40+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","triaged_at":"2026-11-05T05:33:38+00:00","updated_at":"2026-11-05T05:35:00+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-05T05:33:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"LiteSpeed Cache WordPress plugin leaks other shoppers' WooCommerce cart and checkout data","impact":"medium","summary":"The LiteSpeed Cache plugin for WordPress caches WooCommerce cart and checkout responses as public pages, so one shopper's personal data can be served to anyone who visits next. An unauthenticated attacker can read another shopper's name, address, email, phone, cart contents, and session token, which can enable checkout session hijacking.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","litespeed-cache","ecommerce"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Other shoppers' personal details and session tokens are readable without login","analyst_note":"Confirm the fixed version of LiteSpeed Cache after 7.9.1 and whether the vendor advisory names a patch or setting change; the NVD entry alone gives no fix.","how_to_check":"- Check the installed LiteSpeed Cache plugin version in WordPress admin under Plugins; affected versions are up to and including `7.9.1`.\n- Confirm whether the Cache REST option (`cache-rest`) is enabled in the LiteSpeed Cache settings; the shipped default is `1`.\n- Confirm WooCommerce is installed and its Store API cart and checkout endpoints are reachable.","plain_action":"","needs_analyst":true,"not_affected_if":["cache-rest-disabled","no-woocommerce"],"who_is_affected":"Sites running WordPress with the LiteSpeed Cache plugin at version 7.9.1 or earlier and WooCommerce, where Cache REST is enabled (the shipped default). The exposure is through the public cache of the cart and checkout Store API responses, so stores that do not use WooCommerce or that have Cache REST disabled are not described as affected by the sources. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00081,"input_tokens":4456,"output_tokens":728,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version of LiteSpeed Cache after 7.9.1 and whether the vendor advisory names a patch or setting change; the NVD entry alone gives no fix.","search":"'-2026':14A,17A '-93389':15A,18A '/wc/store/v1/cart':123C '/wc/store/v1/checkout':125C '1':115C '7.9.1':104C 'address':67B,187C 'anoth':63B,177C 'anyon':54B 'api':120C 'attack':60B,174C 'bill':180C 'cach':2A,25B,31B,35B,83C,106C,113C,128C,135C 'cache':21A 'cache-rest':112C 'cart':9A,37B,70B,139C,190C,200C 'cart-token':138C,199C 'cart/checkout':148C 'cart/checkout-session':207C 'checkout':11A,39B,78B,214C 'client':163C 'compani':185C 'content':71B,191C 'cooki':157C 'cookie-less':156C 'custom':95C 'cve':13A,16A 'data':12A,49B,96C 'default':111C 'detail':183C 'disclosur':91C 'ecommerc':22B 'email':68B,188C 'enabl':77B,108C,206C 'endpoint':215C 'get':121C 'hijack':80B,208C 'hit':167C 'includ':103C 'jwt':203C 'key':211C 'later':155C 'leak':5A 'less':158C,162C 'litespe':1A,24B,30B,82C,116C 'litespeed':20A 'litespeed-cach':23B 'litespeed-cache':19A 'live':198C 'lscach':166C 'make':169C 'name':66B,184C 'next':57B 'nonc':205C 'object':129C 'one':45B 'order':210C 'packag':26B 'page':43B 'person':48B,147C 'phone':69B,189C 'plugin':4A,32B,84C 'plus':209C 'possibl':171C 'public':42B,127C 'read':62B,176C 'respons':40B,122C,149C 'rest':107C,114C 'sensit':93C 'serv':52B,152C 'session':73B,79B,143C,202C 'ship':110C,182C 'shopper':7A,46B,64B,145C,178C,196C 'store':117C,119C 'street':186C 'therefor':151C 'token':74B,140C,161C,201C 'token-less':160C 'total':193C 'unauthent':59B,90C,173C 'vari':133C 'version':99C 'visit':56B 'vulner':88C 'woocommerc':8A,27B,36B,94C,118C,142C 'wordpress':3A,28B,34B,86C","nicknames":[],"mitigations":[],"who_affected":"WordPress stores running WooCommerce with LiteSpeed Cache 7.9.1 or earlier and the Cache REST API setting on (the default). Cached cart and checkout responses can be served to an unauthenticated visitor, exposing another shopper's name, address, email, phone, cart contents and cart/checkout session credentials. Sites without WooCommerce, with Cache REST API off, or on 7.9.2+ can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T05:35:00Z","by":"analyst","doc":"https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/","run_id":1756},"products":{"at":"2026-11-05T05:35:00Z","by":"analyst","doc":"https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/","run_id":1756},"how_to_check":{"at":"2026-11-05T05:35:00Z","by":"analyst","doc":"https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/","run_id":1756},"who_affected":{"at":"2026-11-05T05:35:00Z","by":"analyst","doc":"https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/","run_id":1756}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["litespeedcache"],"ptokens":["cache","litespeed"],"labels":["ecommerce","high","litespeedcache","package","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-05T05:18:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93389","severity":null,"published_at":"2026-11-05T05:18:40+00:00","modified_at":"2026-11-05T05:18:40+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","fetched_at":"2026-11-05T05:31:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-93389:1756","url":"https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/","severity":null,"published_at":"2026-11-05T05:35:00+00:00","modified_at":"2026-11-05T05:35:00+00:00","first_seen_at":"2026-11-05T05:35:00+00:00","fetched_at":"2026-11-05T05:35:00+00:00","note":"LiteSpeed's own post confirms fix in 7.9.2 (released to WordPress repo Oct 19, 2026); conditions: Cache REST API on (default), WooCommerce active, a shopper used cart/checkout. No exploitation or PoC found; X not checked. Vendor names no workaround.","cites":["https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/","https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-791-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cartcheckout-pii-cart-token-via-public-rest-caching"]}],"documents":[{"id":73631,"url":"https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/","title":"Security Update for LSCWP (LiteSpeed Blog)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":73632,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-791-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cartcheckout-pii-cart-token-via-public-rest-caching","title":"Wordfence: LiteSpeed Cache <= 7.9.1 Unauthenticated Sensitive Information Disclosure","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}