ZeroDay Findings
Sign inSign up

Findings

CVE-2026-3058

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the AJAX action with .

Published Mar 4, 2026 · updated Jun 17, 2026 · s-sols seraphinite accelerator

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the AJAX action with . This is due to the function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled task information, and external database state.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 4, 2026 · NIST NVD

    Detected

    The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the AJAX action with . This is due to the function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled

  2. Jun 17, 2026 · NIST NVD

    Updated

    The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the AJAX action with . This is due to the function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled

Affected

  • cpe s-sols/seraphinite acceleratorversion unspecified

Sources

  • NIST NVDVulnerability recordCVE-2026-3058

    The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the AJAX action with . This is due to the function not performing any capabilit

    nvd.nist.gov

References