Threats tagged 'ghsa-3925-rqgx-v77p'

The LiteSpeed Cache plugin for WordPress versions up to and including 7.9.1 has a vulnerability that allows unauthenticated attackers to access sensitive WooCommerce customer data. When the Cache REST feature is enabled (default setting), personalized WooCommerce Store API GET responses are cached publicly without varying by session tokens. This flaw enables attackers to retrieve other shoppers' billing and shipping information, cart contents, and session tokens, potentially hijacking live cart sessions.