CVE-2026-104006

Name of the Vulnerable Software and Affected Versions SpeedyCache – Cache, Optimization, Performance versions prior to 1.4.3

Description An issue exists where unauthenticated attackers can extract the full name and email address of returning commenters. This occurs because the plugin fails to implement a check on the write path in advanced-cache.php, allowing cache poisoning. When a returning commenter's information is pre-filled into comment form input fields via the comment author * and comment author email * parameters, this data can be persisted as the site-wide cached page. Consequently, any other unauthenticated attacker requesting the same public URL can access this sensitive information.

Recommendations Update the plugin to a version newer than 1.4.2.