# CVE-2026-93389: LiteSpeed Cache for WordPress WooCommerce data disclosure

Source: https://junglewise.ai/threats/cve-2026-93389-the-litespeed-cache-plugin-for-wordpress-is-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-93389 · Severity: high · CVSS 8.2 · Published 2026-11-05

LiteSpeed Cache is a WordPress performance plugin that improperly caches WooCommerce shopping cart and checkout data as publicly accessible content. An attacker can view other customers' billing addresses, phone numbers, email addresses, cart contents, and session tokens without authentication, enabling account hijacking and further fraud.

Technologies: [LiteSpeed Cache for WordPress](https://junglewise.ai/threats/technologies/cache-for-wordpress). Vendors: [LiteSpeed](https://junglewise.ai/threats/vendors/litespeed).

## Quick answers

**Is CVE-2026-93389 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93389 being exploited in the wild.

**How severe is CVE-2026-93389?** High severity, with a CVSS score of 8.2, published 5 November 2026.

**Which products and versions are affected?** LiteSpeed Cache for WordPress up to 7.9.1.

**Is there a fix for CVE-2026-93389?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93389 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93389?** Check whether you run LiteSpeed Cache for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin stores WooCommerce Store API responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects without varying the cache on Cart-Token or WooCommerce session identifiers when Cache REST is enabled (default). This allows any unauthenticated client to retrieve a cached response belonging to a previous shopper, exposing billing/shipping details, cart contents, session JWTs, nonces, and order keys. The vulnerability requires network access and affects all versions up to 7.9.1.

## Affected products

- LiteSpeed LiteSpeed Cache for WordPress up to 7.9.1

## Timeline

- 2026-11-05: disclosed

## References

- [https://plugins.trac.wordpress.org/changeset/3757253/litespeed-cache/trunk/src/control.cls.php](https://plugins.trac.wordpress.org/changeset/3757253/litespeed-cache/trunk/src/control.cls.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/4a66498d-7cf0-4480-b946-94e38f8fd350?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/4a66498d-7cf0-4480-b946-94e38f8fd350?source=cve)