Answer in brief
CVE-2026-90960 records a Medium severity (CVSS 5.3) vulnerability in Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory. The current sources do not mark it as known exploited. The current feed maps seraphinitesoft/Seraphinite Accelerator (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps seraphinitesoft/Seraphinite Accelerator (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| seraphinitesoft/Seraphinite Acceleratorgeneric | >=0 <=2.29.24 | Not reported |
Published upstream
Oct 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 31, 2026
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
Quoted source text, attributed separately from HOL analysis.