LiteSpeed Cache plugin exposes shoppers' cart and checkout data
Shoppers' addresses and phone numbers on WordPress stores can be seen by others.
Summary
The LiteSpeed Cache WordPress plugin can serve one shopper's billing details, cart contents and session token to other visitors. Unauthenticated attackers can read them, and all versions up to and including 7.9.1 are affected.
Affected when
- Cache REST enabled (shipped default cache-rest=1)
What to do
All versions up to and including 7.9.1 are affected. Check that the installed version is newer than 7.9.1 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen