Seraphinite Accelerator
Monthly
Unauthenticated attackers can read complete WordPress user records - including plaintext user_login and user_email, the hashed user_pass, and user_activation_key - from predictable gzip-serialized object-cache files written by the Seraphinite Accelerator plugin in all versions up to and including 2.29.24. The flaw is in WP_Object_Cache::_getFilePath, which maps user cache entries to directly fetchable files under wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. Exploitation is gated on two conditions: the plugin's Object Cache feature must be enabled, and the attacker must first cause the target user's record to be cached (the advisory names an unauthenticated REST API request as the trigger) before retrieving the resulting file; no public exploit code or CISA KEV entry was identified at time of analysis. Because the disclosure is scoped to one user record per request and the leaked password material is hashed rather than plaintext, the practical severity rests on credential-harvesting and account-enumeration value rather than direct authentication bypass.
Denial of service in the Seraphinite Accelerator WordPress plugin (all versions before 2.29.24) lets any authenticated low-privilege account - a Subscriber, for instance - invoke a state-update AJAX action that performs no capability check and plant a malformed value, which triggers an uncaught error on every subsequent wp-admin page load and locks all administrators out of the dashboard. The public-facing site remains online and the condition is reversible by clearing the corrupted plugin state, but administrators lose access to their own admin area for as long as it persists. Publicly available exploit code exists, EPSS is low at 0.17% (7th percentile), and there is no CISA KEV confirmation of active exploitation; this is a moderate, security-team-actionable but not emergency-priority issue.
Reflected Cross-Site Scripting in the Seraphinite Accelerator WordPress plugin (versions ≤ 2.29.15) allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by exploiting a PHP type-juggling flaw that completely bypasses the plugin's HMAC signature verification. The root cause is a two-part chain: the `CacheExtractPreparePageParams()` function uses PHP's loose `!=` operator to validate the nonce, which allows a JSON-decoded boolean `true` to compare as equal to any non-empty HMAC string, and the `_CbContentFinishSkip()` function then concatenates the attacker-controlled `selfTest` field from that unverified payload directly into the HTML response with no escaping. No public exploit or CISA KEV listing has been identified at time of analysis, but a patched version (2.29.18) is available and the Wordfence changeset confirms the vulnerable code paths.
The Seraphinite Accelerator WordPress plugin through version 2.28.14 fails to validate user permissions on the `seraph_accel_api` AJAX endpoint, allowing authenticated subscribers and above to access sensitive operational data including cache status and database state. An attacker with a basic WordPress account can exploit the missing capability checks in the `OnAdminApi_GetData()` function to enumerate system information without administrative rights. No patch is currently available for this information disclosure vulnerability.
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seraphinite Solutions Seraphinite Accelerator allows Reflected XSS.20.28. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated attackers can read complete WordPress user records - including plaintext user_login and user_email, the hashed user_pass, and user_activation_key - from predictable gzip-serialized object-cache files written by the Seraphinite Accelerator plugin in all versions up to and including 2.29.24. The flaw is in WP_Object_Cache::_getFilePath, which maps user cache entries to directly fetchable files under wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. Exploitation is gated on two conditions: the plugin's Object Cache feature must be enabled, and the attacker must first cause the target user's record to be cached (the advisory names an unauthenticated REST API request as the trigger) before retrieving the resulting file; no public exploit code or CISA KEV entry was identified at time of analysis. Because the disclosure is scoped to one user record per request and the leaked password material is hashed rather than plaintext, the practical severity rests on credential-harvesting and account-enumeration value rather than direct authentication bypass.
Denial of service in the Seraphinite Accelerator WordPress plugin (all versions before 2.29.24) lets any authenticated low-privilege account - a Subscriber, for instance - invoke a state-update AJAX action that performs no capability check and plant a malformed value, which triggers an uncaught error on every subsequent wp-admin page load and locks all administrators out of the dashboard. The public-facing site remains online and the condition is reversible by clearing the corrupted plugin state, but administrators lose access to their own admin area for as long as it persists. Publicly available exploit code exists, EPSS is low at 0.17% (7th percentile), and there is no CISA KEV confirmation of active exploitation; this is a moderate, security-team-actionable but not emergency-priority issue.
Reflected Cross-Site Scripting in the Seraphinite Accelerator WordPress plugin (versions ≤ 2.29.15) allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by exploiting a PHP type-juggling flaw that completely bypasses the plugin's HMAC signature verification. The root cause is a two-part chain: the `CacheExtractPreparePageParams()` function uses PHP's loose `!=` operator to validate the nonce, which allows a JSON-decoded boolean `true` to compare as equal to any non-empty HMAC string, and the `_CbContentFinishSkip()` function then concatenates the attacker-controlled `selfTest` field from that unverified payload directly into the HTML response with no escaping. No public exploit or CISA KEV listing has been identified at time of analysis, but a patched version (2.29.18) is available and the Wordfence changeset confirms the vulnerable code paths.
The Seraphinite Accelerator WordPress plugin through version 2.28.14 fails to validate user permissions on the `seraph_accel_api` AJAX endpoint, allowing authenticated subscribers and above to access sensitive operational data including cache status and database state. An attacker with a basic WordPress account can exploit the missing capability checks in the `OnAdminApi_GetData()` function to enumerate system information without administrative rights. No patch is currently available for this information disclosure vulnerability.
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seraphinite Solutions Seraphinite Accelerator allows Reflected XSS.20.28. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.