---
id: "CVE-2026-93389"
kind: "vulnerability"
aliases: ["CVE-2026-93389"]
title: "LiteSpeed Cache WordPress plugin leaks other shoppers' WooCommerce cart and checkout data"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "litespeed-cache", "fixed": ["7.9.2"], "affected": "<= 7.9.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["ecommerce", "litespeed-cache", "package", "woocommerce", "wordpress"]
not_affected_if: ["cache-rest-disabled", "no-woocommerce"]
published_at: "2026-11-05T05:18:40+00:00"
first_seen_at: "2026-11-05T05:31:54+00:00"
updated_at: "2026-11-05T05:35:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93389", "first_seen_at": "2026-11-05T05:31:54+00:00"}, {"source": "analyst", "url": "https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/", "first_seen_at": "2026-11-05T05:35:00+00:00", "cites": ["https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/", "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-791-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cartcheckout-pii-cart-token-via-public-rest-caching"]}]
exploit_sources: []
---

# LiteSpeed Cache WordPress plugin leaks other shoppers' WooCommerce cart and checkout data

The LiteSpeed Cache plugin for WordPress caches WooCommerce cart and checkout responses as public pages, so one shopper's personal data can be served to anyone who visits next. An unauthenticated attacker can read another shopper's name, address, email, phone, cart contents, and session token, which can enable checkout session hijacking.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:litespeed-cache affected <= 7.9.1 fixed 7.9.2

## How to check

- WordPress admin > Plugins: LiteSpeed Cache 7.9.1 or earlier is affected; 7.9.2+ is patched.
- Only exposed if all are true (per LiteSpeed): LiteSpeed Cache > Cache > Cache REST API is ON (the default), WooCommerce is installed and active with cart/checkout in use, and at least one shopper has used the cart or checkout.
- Also check: if you cannot update yet, turning Cache REST API off is a reasonable stopgap (not stated by the vendor); purge the LiteSpeed cache after updating so previously cached cart/checkout responses are not served.

## Fix

Update LiteSpeed Cache to 7.9.2 or later (vendor: released Oct 19, 2026). Vendor names no other setting change.

## Timeline

- 2026-11-05T05:31:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93389
- 2026-11-05T05:35:00+00:00 analyst https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/ — LiteSpeed's own post confirms fix in 7.9.2 (released to WordPress repo Oct 19, 2026); conditions: Cache REST API on (default), WooCommerce active, a shopper used cart/checkout. No exploitation or PoC found; X not checked. Vendor names no workaround.

## Documents

- [advisory] Security Update for LSCWP (LiteSpeed Blog) https://blog.litespeedtech.com/2026/11/04/security-update-for-lscwp-cve-2026-93389/
- [describes] Wordfence: LiteSpeed Cache <= 7.9.1 Unauthenticated Sensitive Information Disclosure https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-791-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cartcheckout-pii-cart-token-via-public-rest-caching

## From the sources

The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_