Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90960— Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory

Quick assessment

Affected
seraphinitesoft Seraphinite Accelerator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 Seraphinite Accelerator 在所有 2.29.24 及以下版本中存在敏感信息泄露漏洞。该漏洞源于 函数，使得未经身份验证的攻击者能够从位于 的可预测 gzip 序列化缓存文件中，提取完整的 WordPress 用户记录。泄露的信息包括明文的用户名（ ）、邮箱地址（ ）、哈希化的密码（ ）以及用户激活密钥（ ）。 该漏洞仅在插件启用了“对象缓存（Object Cache）”功能时才可被利用。攻击者需先通过未经身份验证的请求（例如 REST API 请求）触发目标用户记录的

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90960

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory
Source: CVE Program / CVE List V5
Vulnerability Description
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
seraphinitesoft Seraphinite Accelerator 0 ~ 2.29.24 -

II. Public POCs for CVE-2026-90960

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90960

请登录查看更多情报信息。

Other References for CVE-2026-90960 (9)

IV. Related Vulnerabilities

Same product: Seraphinite Accelerator
Same vendor: seraphinitesoft
Same weakness: CWE-200