Executive brief
The Seraphinite Accelerator WordPress plugin is a performance optimization tool used by website administrators. Versions before 2.29.24 contain a flaw that allows low-privilege users (such as subscribers) to trigger a denial-of-service attack by sending a malformed request to an AJAX endpoint. This causes the WordPress admin dashboard to crash on every load, rendering it completely inaccessible to administrators and effectively shutting down site management capabilities.
Technical details
The plugin's seraph_accel_State AJAX action fails to validate user capabilities before processing state-update requests, allowing authenticated users with low privilege levels to submit malformed data. The vulnerability is in the AJAX endpoint's insufficient authorization checks (missing capability verification). An attacker who is authenticated as a low-privilege user (e.g., subscriber) can craft a malicious AJAX request containing a malformed value. When processed, this value triggers an uncaught error that persists in the WordPress database, causing the error to occur on every subsequent admin page load for all administrators. The vulnerability has been patched in version 2.29.24.
Affected products
- Seraphinite Accelerator before 2.29.24
Timeline
- 2026-09-14: disclosed: Publicly disclosed
- 2026-09-16: patched: Fixed in version 2.29.24