CVE-2026-90960

Name of the Vulnerable Software and Affected Versions Seraphinite Accelerator versions prior to 2.29.25

Description An issue exists in the WP Object Cache:: getFilePath function that allows unauthenticated attackers to extract complete WordPress user records. This includes plaintext user login, user email, hashed user pass, and user activation key. The information is stored in predictable gzip-serialized cache files located at the endpoint wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER ID>.dat.gz. This is exploitable when the Object Cache feature is enabled and requires the attacker to trigger the caching of a target user record, such as through an unauthenticated REST API request, before retrieving the file.

Recommendations Update to a version newer than 2.29.24. As a temporary mitigation, disable the Object Cache feature.