WordPress Plugin Vulnerabilities
SpeedyCache < 1.4.3 - Unauthenticated Sensitive Information Exposure via Missing comment_author Cookie Check on Cache Write
Description
The plugin is vulnerable to Sensitive Information Exposure via the comment_author / comment_author_email cookies. The full name and email address of returning commenters, pre-filled into comment form input fields, are persisted into the site-wide cached page and can be extracted by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author cookies, but this check is absent on the write path, so the cache write is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.
Affects Plugins
References
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Kuba
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-10-09 (about 8 days ago)
Added
2026-10-10 (about 7 days ago)
Last Updated
2026-10-10 (about 7 days ago)