Seraphinite Accelerator EUVD-2026-114604

Two concrete prerequisites, both drawn from the description: (1) the plugin's Object Cache feature must be ENABLED - this is the hard gate and is not necessarily a default for all installs, which materially limits the exposed population; and (2) the attacker must first cause the target user's record to be cached (the advisory names an unauthenticated REST API request as the trigger) before the serialized file exists on disk. Once both hold, retrieval is unauthenticated and remote: the cache path wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz is predictable and directly fetchable over HTTP. Limiting factors: exposure is per-user-ID (requires enumerating/triggering each record), depends on web-server access to the wp-content/cache directory, and does not apply when Object Cache is disabled.

This is a genuine, prioritizable issue rather than a CVSS-inflated non-event, but it sits below emergency tier. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw - all the signals that normally drive urgency. NVD scored it only 5.3 because it rated confidentiality impact as Low (C:L), yet the described data exposure is severe: complete WordPress user records including user_login, user_email, hashed user_pass, and user_activation_key. The activation key in particular enables password-reset/account-takeover chains, so the real confidentiality impact is arguably High and the 5.3 base score understates business risk. Countervailing factors: exploitation is gated on the plugin's Object Cache feature being enabled (not universally on) and on the attacker first triggering caching of each target record, so impact is per-user and configuration-dependent rather than a single bulk dump. No EPSS score was supplied, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no SSVC decision block was provided; the only priority signal is the vuln.today 'this_month' label, consistent with a credible but not actively-exploited bug. No public exploit identified at time of analysis. Net: patch within a normal monthly cycle, sooner for sites with Object Cache enabled and sensitive user bases.

An unauthenticated attacker sends a crafted REST API request that causes the Seraphinite Accelerator Object Cache to serialize a target user's record to disk, then directly requests the predictable gzip cache file (wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz) over HTTP to harvest the user_login, user_email, hashed user_pass, and user_activation_key. Iterating over user IDs yields the full user table, enabling offline hash cracking and activation-key-based account takeover. No public exploit identified at time of analysis, though the Wordfence advisory and source-code references make the mechanism clear.