Seraphinite Accelerator CVE-2026-17532

Exploitation requires that the Seraphinite Accelerator plugin is installed and active on a WordPress site running a version at or below 2.29.15. The vulnerable code path is triggered only when a request arrives with the seraph_accel_prep query parameter present, which invokes the plugin's cache self-test mechanism - this endpoint is accessible without authentication (PR:N confirmed by CVSS vector). The critical limiting factor is that the attack is reflected, not stored: the victim must actively click a specially crafted link delivered by the attacker (UI:R confirmed by CVSS). This confines realistic exploitation to targeted phishing scenarios rather than passive mass compromise. No non-default WordPress configuration is required; the vulnerable parameter handling is part of the plugin's default operation. Exploitation is bounded to sites where this specific plugin is installed and active.

The CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately reflects the reflected XSS nature of this vulnerability: no authentication is required and the attack complexity is low, but exploitation requires social engineering to make a victim click a crafted link (UI:R), which limits mass exploitation. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. This is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, meaning this is a theoretical risk rather than a confirmed active threat. The attack is automatable in delivery (send a link) but depends on user interaction for execution, making opportunistic mass exploitation unlikely while targeted phishing campaigns remain plausible. The scope change (S:C) reflects that JavaScript executes in the victim's browser session, potentially enabling session hijacking or credential theft against WordPress admin users. Priority should be elevated for sites where WordPress admins regularly follow links from untrusted sources.

An attacker constructs a URL targeting a WordPress site running Seraphinite Accelerator ≤ 2.29.15, encoding a seraph_accel_prep parameter containing a JSON object where nonce is set to the boolean true and selfTest contains a malicious <script> tag. The attacker then sends this link via phishing email or social media to a WordPress site administrator; when the admin clicks the link and the page loads, the plugin's HMAC check is bypassed by PHP's loose comparison, the injected script is reflected into the HTML response, and the attacker's JavaScript executes in the admin's browser session, potentially stealing authentication cookies or performing actions on the WordPress dashboard on behalf of the victim.