Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-3058 EUVD-2026-9395GHSA-j4v5-x6jp-h7cf

Seraphinite Accelerator <= 2.28.14 - Authenticated (Subscriber+) Exposure of Sensitive Information to an Unauthorized Actor

Published Mar 4, 2026 · Updated Apr 8, 2026 · Assigned by Wordfence

Description

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the `seraph_accel_api` AJAX action with `fn=GetData`. This is due to the `OnAdminApi_GetData()` function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled task information, and external database state.

Affected products

VendorProductAffectedFixed
seraphinitesoft Seraphinite Accelerator ≤ 2.28.14 —

References