SpeedyCache CVE-2026-104006

Requires SpeedyCache page caching to be active and the site to accept public comments with the standard WordPress 'remember me' comment cookies, so that returning commenters have comment_author_*/comment_author_email_* cookies that pre-fill the comment form. Exploitation is gated by the vulnerable write path in cache.php/advanced-cache.php caching a page that was rendered for a cookie-bearing returning commenter; the attacker must then request that same public URL before the cache entry is regenerated. Limiting factors: it leaks only the name/email of whichever commenter's personalized render happened to be cached (not an arbitrary user database), depends on a victim first submitting a comment and later triggering a cache-miss write while authenticated via cookies, and the timing/conditions outside the attacker's control account for the AC:H rating.

This is a genuinely low-severity issue despite being remotely reachable, and the available signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) correctly captures the shape of the flaw: network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) because successful exploitation depends on a returning commenter first triggering the vulnerable cache write, and limited to a low-confidentiality leak (C:L, no integrity or availability impact). No EPSS score, KEV listing, or SSVC decision data was supplied, and no public exploit code is referenced - only Wordfence's threat-intel entry and the WordPress plugin source/changeset links. There is no active-exploitation signal, so exploitation status is 'no public exploit identified at time of analysis.' The one subtlety worth flagging: the description explains a real asymmetry (the read path in advanced-cache.php correctly skips cached delivery for requests bearing comment_author_* cookies, but the write path lacks the same guard), which makes the poisoning plausible but still bounded by the AC:H conditions. Net: this is a real but low-priority information-disclosure bug suited to routine patching, not an emergency - no signal elevates it beyond its modest CVSS.

A returning commenter on a SpeedyCache-enabled WordPress site requests a public page while carrying their comment_author_* cookies; the plugin renders the comment form pre-filled with their name and email and, lacking a guard on the write path, persists that personalized HTML as the site-wide cached copy of the page. An unauthenticated attacker then simply requests the same public URL with no cookies and receives the cached page containing the victim's full name and email address. No public exploit code is referenced, and the attack depends on timing the request against a victim-triggered cache write (AC:H).