CVE-2026-3056
Unauthorized Data Modification in Seraphinite Accelerator WordPress Plugin
Publication date: 2026-03-04
Last updated on: 2026-03-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| seraphinite | seraphinite_accelerator | to 2.28.14 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Seraphinite Accelerator plugin for WordPress has a vulnerability due to a missing capability check on the AJAX action `seraph_accel_api` when called with the parameter `fn=LogClear`. This flaw exists in all versions up to and including 2.28.14.
Because of this, authenticated users with Subscriber-level access or higher can clear the plugin's debug and operational logs without proper authorization.
How can this vulnerability impact me? :
This vulnerability allows attackers who have at least Subscriber-level access to clear the plugin's debug and operational logs.
The impact is limited to unauthorized modification of data, specifically the deletion of logs that could be used for troubleshooting or auditing plugin activity.
The CVSS score of 4.3 (Medium severity) reflects that the vulnerability requires low attack complexity and privileges but does not affect confidentiality or availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized modification of data via the `seraph_accel_api` AJAX action with the parameter `fn=LogClear`. Detection can focus on monitoring AJAX requests to this endpoint, especially those attempting to clear logs.
To detect exploitation attempts on your system or network, you can monitor HTTP requests for POST or GET calls to the WordPress admin AJAX endpoint (`wp-admin/admin-ajax.php`) with the parameter `action=seraph_accel_api` and `fn=LogClear`.
- Use web server access logs to search for requests like: `admin-ajax.php?action=seraph_accel_api&fn=LogClear`.
- Example command to search Apache or Nginx logs for such requests: `grep 'admin-ajax.php?action=seraph_accel_api&fn=LogClear' /var/log/apache2/access.log`
- Use network monitoring tools or IDS/IPS to alert on HTTP requests containing these parameters.
- Within WordPress, review plugin debug or operational logs for unexpected clearing or absence of log entries.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable AJAX action and updating the plugin.
- Update the Seraphinite Accelerator plugin to version 2.28.15 or later, where the missing capability check is presumably fixed.
- Restrict access to the `seraph_accel_api` AJAX action with `fn=LogClear` to only trusted users with appropriate capabilities.
- Implement web application firewall (WAF) rules to block unauthorized requests attempting to clear logs via this AJAX action.
- Monitor and audit user roles and permissions to ensure that only trusted users have Subscriber-level access or higher.