High priorityDisclosed

Advisory · CVE-2026-93389

LiteSpeed Cache can serve one shopper's checkout to anyone

LiteSpeed Cache up to and including 7.9.1 stores WooCommerce Store API cart and checkout responses as public cache objects without varying on the Cart-Token or session, so an unauthenticated attacker can read another shopper's billing details and live session token. Wordfence rates it CVSS 3.1 8.2.

Advisory published November 5, 2026Independent summary
Vendor
LiteSpeed Cache
Product
LiteSpeed Cache
Identifier / CWE
CVE-2026-93389
CWE-200
Action timing
Immediate
ELI5

Explain it like I’m five

The cache saves a shopper's checkout page as if it were public, then hands it to the next stranger who asks. Name, address, and the live session token all come with it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Cache REST enabled

    LiteSpeed Cache runs with Cache REST enabled, the shipped default, and stores WooCommerce Store API GET responses as public cache objects.

  2. 02No session varying

    The cache does not vary on the Cart-Token or WooCommerce session.

  3. 03Another shopper's response served

    A later cookie-less, token-less client receives the earlier shopper's cart or checkout response as a cache hit.

  4. 04Data and session exposed

    Billing and shipping details, cart contents, the live Cart-Token session JWT and nonce, and the order_key are disclosed, enabling cart and checkout session hijack.

What happened

The LiteSpeed Cache plugin for WordPress up to and including 7.9.1 is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data. With Cache REST enabled, the shipped default, LiteSpeed stores WooCommerce Store API GET responses for /wc/store/v1/cart and /wc/store/v1/checkout as public cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper’s personalized cart or checkout response is therefore served to any later cookie-less and token-less client as a cache hit, disclosing billing and shipping details, cart contents and totals, the live Cart-Token session JWT and nonce, and the order_key on the checkout endpoint.

Wordfence rates it CVSS 3.1 8.2 and identifies versions up to and including 7.9.1 as affected.

What to do

  1. Upgrade LiteSpeed Cache to the latest release beyond 7.9.1 using the vendor’s guidance.
  2. While remediation is underway, consider disabling Cache REST or excluding the WooCommerce Store API endpoints from caching.
  3. Purge the full page cache after upgrading so no stored cart or checkout responses are served.
  4. Review access logs for unauthenticated requests to /wc/store/v1/cart and /wc/store/v1/checkout that returned cache hits.
  5. Treat exposed Cart-Token session JWTs as compromised and invalidate affected shopper sessions.

Management note

A caching layer that serves personalized checkout data to strangers turns a performance feature into a data breach. The exposure window is the cache lifetime, so purge first and investigate the logs second.