WordPress Plugin Vulnerabilities

SpeedyCache < 1.4.3 - Unauthenticated Sensitive Information Exposure via Missing comment_author Cookie Check on Cache Write

Description

The plugin is vulnerable to Sensitive Information Exposure via the comment_author / comment_author_email cookies. The full name and email address of returning commenters, pre-filled into comment form input fields, are persisted into the site-wide cached page and can be extracted by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author cookies, but this check is absent on the write path, so the cache write is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.

Affects Plugins

Fixed in 1.4.3

References

Classification

Type
SENSITIVE DATA DISCLOSURE
CWE
CVSS

Miscellaneous

Original Researcher
Kuba
Verified
No

Timeline

Publicly Published
2026-10-09 (about 8 days ago)
Added
2026-10-10 (about 7 days ago)
Last Updated
2026-10-10 (about 7 days ago)

Other