LiteSpeed Cache EUVD-2026-117326

Requires the LiteSpeed Cache plugin (≤7.9.1) with its Cache REST feature enabled, which is the shipped default (cache-rest=1), on a site also running WooCommerce with the Store API active (/wc/store/v1/cart and /wc/store/v1/checkout). Exploitation further depends on a prior shopper having generated a personalized cart/checkout response that LiteSpeed cached as a public object without varying on Cart-Token or WooCommerce session, after which any cookie-less, token-less client is served that response as a cache HIT. Limiting factors: the attack only works where WooCommerce Store API responses are actually being cached, and disclosure is opportunistic and cache-state-dependent - the attacker receives whatever shopper response currently occupies the cache rather than selecting a specific victim. No authentication and no attacker-side user interaction are needed.

This is a genuine, actionable priority rather than an inflated CVSS number. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:L) is internally consistent with the mechanism described: an unauthenticated, network-reachable information-disclosure flaw that works against the shipped default configuration (cache-rest=1), so no privileges, no attacker-side user interaction, and low attack complexity. The 8.2 (High) rating is credible because the disclosed data is not trivial - it includes full billing/shipping PII plus live Cart-Token session JWTs and nonces, which the description says enable cart/checkout-session hijack, justifying the I:L component. Signals are partially missing: no EPSS exploitation-probability score is provided, and the CVE is NOT in CISA KEV, so there is no confirmation of active exploitation - treat this as not-yet-exploited rather than low-risk. No PoC or working exploit reference is present (the only non-vendor reference is the WordPress plugin source changeset, i.e. the fix, not an exploit). The vuln.today decision label is 'this_week', which aligns with 'patch promptly' urgency, not emergency. Net: a high-impact, easy-to-trigger default-config PII/session leak in a very widely deployed plugin, with no evidence of exploitation yet - remediate on a this-week cadence.

An unauthenticated attacker repeatedly requests the cached WooCommerce Store API endpoints (/wc/store/v1/cart and /wc/store/v1/checkout) on a target store running LiteSpeed Cache with its default Cache REST setting. Because the response was cached as a public object without varying on Cart-Token or session, the attacker receives another shopper's cached cart/checkout response as an LSCache HIT, exposing that shopper's billing/shipping PII, cart contents, and live Cart-Token JWT and nonce. No public exploit identified at time of analysis, but the technique requires only ordinary HTTP GET requests given the low attack complexity and lack of authentication.