sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total12
Critical0
High1
Medium11
Reset
Showing 1-12 of 12 records
Threat Entry Updated 2026-11-06

Seraphinite Accelerator - Security Vulnerability (CVE-2026-90960)

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.29.24 via the WP_Object_Cache::_getFilePath. This makes it possible for unauthenticated attackers to extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting…

PLUGIN Seraphinite Accelerator

CVE-2026-90960

MEDIUM CVSS 5.3 2026-10-31
Open Full Technical Breakdown
Threat Entry Updated 2026-09-17

Seraphinite Accelerator - Security Vulnerability (CVE-2026-87828)

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).

PLUGIN Seraphinite Accelerator

CVE-2026-87828

MEDIUM CVSS 5.7 2026-09-16
Open Full Technical Breakdown
Threat Entry Updated 2026-08-12

Seraphinite Accelerator - Cross-Site Scripting (XSS) (CVE-2026-17532)

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams() function using PHP's loose inequality operator (!=) to compare the expected HMAC string against the JSON-decoded 'nonce' value — supplying the JSON boolean true causes any non-empty HMAC string to compare as loosely equal, bypassing the signature check — combined with insufficient output escaping in the _CbContentFinishSkip() function, which concatenates the attacker-controlled 'selfTest' field directly into the HTML response body. This…

PLUGIN Seraphinite Accelerator

CVE-2026-17532

MEDIUM CVSS 6.1 2026-08-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Seraphinite Accelerator - Information Disclosure (CVE-2026-3058)

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the `seraph_accel_api` AJAX action with `fn=GetData`. This is due to the `OnAdminApi_GetData()` function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled task information, and external database state.

PLUGIN Seraphinite Accelerator

CVE-2026-3058

MEDIUM CVSS 4.3 2026-03-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Seraphinite Accelerator - Broken Access Control (CVE-2026-3056)

The Seraphinite Accelerator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `seraph_accel_api` AJAX action with `fn=LogClear` in all versions up to, and including, 2.28.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's debug/operational logs.

PLUGIN Seraphinite Accelerator

CVE-2026-3056

MEDIUM CVSS 4.3 2026-03-04
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Seraphinite Accelerator - Cross-Site Request Forgery (CSRF) (CVE-2025-6059)

The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApi_CacheOpBegin' function. This makes it possible for unauthenticated attackers to perform several administrative actions, including deleting the cache, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Seraphinite Accelerator

CVE-2025-6059

MEDIUM CVSS 4.3 2025-06-14
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Seraphinite Accelerator - Server-Side Request Forgery (SSRF) (CVE-2024-1568)

The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

PLUGIN Seraphinite Accelerator

CVE-2024-1568

MEDIUM CVSS 6.4 2024-02-28
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.