LiteSpeed Cache, a 7 million-install plugin, leaked WooCommerce carts
CVE-2026-93389 let anyone read other shoppers' cart and checkout data by hitting a cached Store API response. Fixed quietly in 7.9.2, disclosed weeks later.
LiteSpeed Cache, a caching plugin with over 7 million active WordPress installs, shipped versions up to 7.9.1 with a bug tracked as CVE-2026-93389. With Cache REST enabled, which is the plugin’s shipped default, LiteSpeed stored responses from WooCommerce’s Store API cart and checkout endpoints as public cache objects, without varying the cache on the shopper’s cart token or session. An unauthenticated visitor hitting a cached URL could get back someone else’s cart contents, checkout data and cart token.
NVD rates it 8.2. Patchstack’s own risk read is lower, flagging it low priority and unlikely to be exploited in practice. The fix shipped in version 7.9.2, which went out on 20 October, weeks before the CVE was published this week. LiteSpeed’s changelog doesn’t name the bug or cite the CVE: the closest line reads only that it “protected unvaried cart responses” and hardened “Force Public safeguards for private and authenticated responses.”
Why it matters: this is cache misconfiguration, not a coding mistake in the usual sense, and it’s exactly the kind of bug a WooCommerce store running any page cache should check for. If you’re on LiteSpeed Cache and sell anything, confirm you’re past 7.9.2.
The caveat: LiteSpeed hasn’t published its own security advisory for this, so the detail here comes from Patchstack’s write-up and NVD’s scoring rather than the vendor. There’s no report of active exploitation and it isn’t on CISA’s KEV list.