CVE-2026-90960
Deferred Deferred - Pending Action

Sensitive Information Exposure in Seraphinite Accelerator WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-90960
EUVD
EUVD-2026-114604

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
seraphinitesoft Seraphinite Accelerator 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Seraphinite Accelerator WordPress plugin up to version 2.29.24 has a flaw where sensitive user data like usernames, emails, and password hashes can be exposed. Attackers can access this data by exploiting predictable cache file paths if the plugin's Object Cache feature is enabled.

Detection Guidance

Check for the presence of cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. If the plugin's Object Cache feature is enabled, unauthenticated attackers may exploit this to access sensitive user data in these files.

Impact Analysis

Unauthenticated attackers could steal user credentials, including hashed passwords, potentially leading to account takeovers. Attackers must first trigger caching of user data before accessing the exposed files.

Compliance Impact

This vulnerability could violate GDPR due to unauthorized access to personal data and HIPAA if user health data is exposed. Organizations must address it to maintain compliance with data protection regulations.

Mitigation Strategies

Disable the Object Cache feature in the Seraphinite Accelerator plugin settings. Update the plugin to the latest version if available. Monitor for unauthorized access to cache files and restrict file permissions on the wp-content/cache directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90960. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart