LiteSpeed Cache for WordPress: CVE-2026-93389 flaw exposes WooCommerce carts

LiteSpeed issued a security advisory on 4 November 2026 for LiteSpeed Cache for WordPress (LSCWP), the server-side caching plugin used across most LiteSpeed hosting. Anyone running WooCommerce stores on LiteSpeed infrastructure should check their installed version: this vulnerability directly impacts customer data during checkout.

What the advisory says

This is an Unauthenticated Sensitive Information Disclosure vulnerability, reported by the Wordfence team and classified as CVE-2026-93389. LiteSpeed patched it in version 7.9.2.

The issue only affects sites where all these conditions are simultaneously true: Cache REST API is set to ON (the default value), WooCommerce is installed and active with cart and checkout in use, and at least one customer has actually used the cart or checkout on the site. If these conditions apply, an unauthenticated attacker can retrieve cached cart or checkout data belonging to another customer: name, address, email, phone number and cart contents. In the worst cases, the exposed information also includes session credentials for that cart, without the attacker needing an account or prior access.

Timeline and required action

LiteSpeed's timeline is as follows: Wordfence reported the issue on 17 September 2026, the patch version 7.9.2 was released to the WordPress plugin repository on 19 October 2026, and on 23 October 2026 version 7.9.2 was added as a stable release in the LiteSpeed plugin control panel.

The recommended action is straightforward: update to 7.9.2 or later. Those who keep the plugin continuously updated need do nothing; anyone who hasn't updated for some time should do so immediately, either through the control panel or via wp plugin update litespeed-cache from the command line if using WP-CLI.

A plugin with a history

LiteSpeed Cache is installed on over 7 million active sites, according to the official plugin page on wordpress.org. This isn't the first critical flaw: in August 2024 an unauthenticated privilege escalation (CVE-2024-28000, CVSS score 9.8) affected over 5 million installations. Version 7.9.3, subsequent to 7.9.2 indicated as the patch for this vulnerability, is already available on the plugin page: users updating today can install the latest release directly.