Security Update for LSCWP

We have a security update for LiteSpeed Cache for WordPress. Recently, we were made aware of a vulnerability in the LiteSpeed Cache for WordPress plugin. We patched it, in v7.9.2.

To protect your WordPress sites, please update to the latest version of the LSCache plugin immediately.

This Unauthenticated Sensitive Information Disclosure vulnerability, reported by the WordFence team, has been assigned CVE-2026-93389.

Impact

This vulnerability affects only sites where all of the following are true:

• Cache > Cache > Cache REST API is set to ON (this is the default).
• WooCommerce is installed and active, and the store uses its cart and checkout features.
• At least one shopper has used the cart or checkout on the site.

If those conditions are met, an unauthenticated attacker could receive another shopper’s cached cart or checkout data. This could include the shopper’s name, address, email, phone number, and cart contents. It could also include session credentials for that shopper’s cart and checkout. The attacker doesn’t need an account or any prior access to the shopper’s session.

Actions

We recommend that every site upgrade to the plugin version 7.9.2 or higher to patch this vulnerability.

Timeline

• September 17, 2026: WordFence alerted us to the issue.
• October 19, 2026: We patched the issue and released v7.9.2 to the WordPress repository
• October 23, 2026: We added v7.9.2 to the list of stable releases in our control panel plugins

Conclusion

We thank WordFence for bringing this issue to our attention. This vulnerability has been patched, so if you are keeping your LiteSpeed Cache plugin up-to-date, there is nothing you need to do. If you have not updated in a while, please do so today.