LiteSpeed Cache can store WooCommerce cart and checkout data in public cache (CVE-2026-93389)
Identifiers: CVE-2026-93389
- Published
- Last substantive change
- Last verified
Last verified: . Attention items are due for re-verification within 72 hours.
Summary
In LiteSpeed Cache 7.9.1 and earlier, with the Cache REST option enabled as shipped by default, WooCommerce Store API cart and checkout responses can be cached publicly without varying on Cart-Token or the WooCommerce session. Later unauthenticated visitors may then receive another customer's billing, shipping and cart details, including live cart-session tokens.
Impact
Customer details and active cart sessions may be exposed to other visitors of the store. The condition requires WooCommerce and a working public LSCache layer; installing the plugin alone is not enough. The reviewed records do not describe payment-card exposure.
Who is affected
WordPress stores running LiteSpeed Cache 7.9.1 or earlier together with WooCommerce, with the Cache REST option enabled, behind an active public LSCache layer.
Products and versions
| Products and versions | Affected | Fixed |
|---|---|---|
| LiteSpeed Cache | <= 7.9.1 | 7.9.2 |
Exploitation evidence
Exploitation not established. The reviewed records do not establish exploitation in the wild.
Actions
- Have your provider check the installed version, the Cache REST setting and whether a public LSCache layer is active.
- After backup and compatibility checks, update to 7.9.2 or a newer patched release (the current stable release is 7.9.3).
- Purge cache entries created before the update.
- Verify session separation using only test accounts and carts you own.
- Patching does not show whether exposure already happened; if evidence appears, follow your provider's incident process.
Unknowns
- Exploitation in the wild is not established by the reviewed records.
- Whether a specific store was affected depends on its own configuration and cannot be determined from the advisory alone.
Sources
- Wordfence CNA / CVE Program https://cveawg.mitre.org/api/cve/CVE-2026-93389
- LiteSpeed Cache / WordPress.org https://plugins.svn.wordpress.org/litespeed-cache/trunk/readme.txt
- Patchstack https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-9-1-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cart-checkout-pii-cart-token-vulnerability
Change history
- — Published: LiteSpeed Cache 7.9.1 and earlier with Cache REST enabled can expose WooCommerce cart and checkout details through a public LSCache layer; update to 7.9.2 or newer and purge the cache.