If your website runs an online store on WordPress, there's a good chance it also runs a speed plugin called LiteSpeed Cache. This week its makers confirmed a flaw that could let a stranger see another customer's name, address and cart. It's already fixed, and the fix is a simple update. Here's what happened, in plain English, and how to check your site.
What happened
LiteSpeed Cache is one of the most popular WordPress plugins out there. WordPress.org lists it on more than 7 million websites. Its job is to make sites load faster by saving copies of pages and handing those copies to the next visitor instead of building the page from scratch every time.
On November 4, LiteSpeed published a security notice about a problem in that saving process, tracked as CVE-2026-93389 and reported by the security team at Wordfence. It affects every version up to and including 7.9.1 and is rated 8.2 out of 10, "High".
Here's the simple version. When a shopper on a WooCommerce store looks at their cart or checkout, that page is personal. It has their details on it. The plugin was saving those personal cart and checkout responses as public copies and serving them to whoever asked next, even someone with no account and no login.
What could be exposed
According to LiteSpeed, someone could receive another shopper's name, address, email, phone number and cart contents, plus the session details tied to that shopper's cart and checkout. The technical write-up adds that the leaked session token could let someone hijack that shopper's cart or checkout session.
Who is affected
Not every site with this plugin. LiteSpeed says it only applies when all three of these are true:
- The plugin's "Cache REST API" setting is on, which is the default.
- WooCommerce is installed and the store uses its cart and checkout.
- At least one shopper has used the cart or checkout.
So if you have a brochure-style website with no store, this one doesn't touch you. If you sell online with WooCommerce and use LiteSpeed Cache, it very likely does, unless you've already updated.
What's been fixed
LiteSpeed's timeline says Wordfence reported the issue on September 17, and the fix shipped in version 7.9.2 on October 19. The current version on WordPress.org is 7.9.3. If your plugins update automatically, you may already be covered. If you haven't updated in a while, LiteSpeed's advice is plain: update today.
To keep this in perspective: as of this writing, it is not on the U.S. government's list of flaws known to be used in attacks, and I haven't seen any confirmed reports of it being exploited. But the details are now public, and this kind of leak doesn't take much skill to try. That's why it's worth five minutes today.
What I'd do this week
- Check your version. Log in to WordPress, go to Plugins, and find LiteSpeed Cache. If it says 7.9.1 or lower, update it to 7.9.2 or later (7.9.3 is current).
- Clear the cache after updating. Old saved copies can hang around. Use the plugin's "Purge All" option so nothing saved before the fix keeps getting served.
- If you can't update right away, have your developer turn off the plugin's Cache REST API setting until you can. That's the setting that triggers the problem.
- Turn on automatic updates for plugins you trust. This fix has been out since October 19. Sites that update on their own were protected before the news even broke.
- Think about your customers. If your store ran an old version for a long time, talk with your developer about whether anything looks off, such as odd orders or customer complaints. If customer data may have been seen, it's worth getting advice on whether you need to tell anyone.
If you're lost, we can help
If you're not sure which plugins your site runs, or the word "cache" makes your eyes glaze over, that's normal. HDM has been building and caring for websites out of Springboro, Ohio for 20 years. Send us a request and we'll check your site and tell you plainly what we find, or call us at (513) 668-7344.
