The Seraphinite Accelerator plugin for WordPress suffers from an information exposure vulnerability (CWE-200) via the seraph_accel_api AJAX action when called with fn=GetData. The underlying issue is that the OnAdminApi_GetData() function does not enforce capability checks, allowing any authenticated user with Subscriber-level privileges or above to access sensitive operational details such as cache status, scheduled tasks, and external database state. This vulnerability affects all versions up to and including 2.28.14. The CVSS 3.1 base score is 4.3, reflecting a low complexity attack vector with limited confidentiality impact and no integrity or availability impact.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable Seraphinite Accelerator plugin can obtain sensitive operational information that is not intended for their role. This exposure could aid in further reconnaissance or targeted attacks but does not directly allow modification or disruption of data or services. There are no reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious access patterns. Avoid granting Subscriber-level or higher privileges to untrusted users. Review plugin updates regularly for a patch addressing this vulnerability.