Speed Optimizer <= 7.8.2 - Unauthenticated Sensitive Information Exposure via Forged Logged-In Cookie in File Cache
- ID
- WPSEC-2026-0276
- Plugin
- Speed Optimizer – The All-In-One Performance-Boosting Plugin (sg-cachepress)
- Affected
- from 7.0.0 before 7.8.3
- Remediation
- Update to 7.8.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Speed Optimizer on WPSec AttackSurface
- Fix released
- Published
Description
The Speed Optimizer plugin for WordPress is vulnerable to Sensitive Information Exposure via the file-based cache in versions 7.0.0 to 7.8.2. When caching for logged-in users was enabled, the cache reader chose each user's cache partition from the username field of the wordpress_logged_in cookie without validating the cookie. This makes it possible for unauthenticated attackers to send a forged cookie carrying another user's username, such as an administrator's, and be served the cached pages that were generated for that user. Exploitation requires file-based caching and its logged-in user caching option to be enabled, and the targeted user to have recently viewed the requested page.
References
- https://wpsec.com/vuln/WPSEC-2026-0276/
- https://plugins.svn.wordpress.org/sg-cachepress/tags/7.8.3/
- https://wordpress.org/plugins/sg-cachepress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS