LiteSpeed Cache: vulnerability exposes shop customer data, update now
The LiteSpeed Cache plugin up to version 7.9.1 can store WooCommerce cart and checkout data as a public page. A stranger who is not logged in can then read another customer's details. It is fixed in version 7.9.2, and the latest version is 7.9.3.
Who is affected
Sites running WooCommerce and LiteSpeed Cache 7.9.1 or older, with REST API caching turned on. That is the default setting. Names, addresses, email addresses, phone numbers, cart contents and shopping session data are at risk. Sites without WooCommerce are not affected by this flaw, but you should still update the plugin.
What to do
- Update. In your admin area, open Plugins and click Update under LiteSpeed Cache. Make a backup first.
- Clear the cache. In the top bar, open LiteSpeed Cache and click Purge All. Otherwise old stored responses could remain.
- Check the version. Plugins must show LiteSpeed Cache 7.9.2 or higher.
If you cannot update
Back up the site, go to LiteSpeed Cache → Cache → Cache, turn off Cache REST API, then click Purge All. The other option is to deactivate the plugin for now. The site will be slower, but customer data will be safe.
How to tell if it happened
This flaw does not give access to the admin area, so it would not leave new administrators or unknown files. Look in your hosting access log for repeated requests to /wp-json/wc/store/v1/cart and /wp-json/wc/store/v1/checkout from unknown addresses. Order changes a customer did not make are also suspicious. If customer data did get out, treat it as a personal data breach. Unknown administrators or redirects would point to a different problem and need checking.
Not sure? Check your site with the Website Checker, or ask me for a security audit. The initial check is free.
Source: CVE-2026-93389, Wordfence.