Wordfence disclosed a LiteSpeed Cache flaw that can serve one WooCommerce shopper’s private cart or checkout response to another visitor. Its CVE-2026-93389 record identifies all plugin versions through 7.9.1 as affected. The record was published on November 5, with disclosure recorded on November 4.

Evidence status: a disclosed vulnerability with a documented repair, not a reported customer breach. The reviewed sources provide no observed attack count or confirmation of exploitation in the wild.

A shared cache loses the shopper’s identity

The flaw concerns WooCommerce Store API responses, which applications use to retrieve shopping-cart and checkout information. With Cache REST API enabled, the vulnerable plugin can store personalized responses in its public cache. Wordfence says the cache fails to separate responses by the shopper’s session or cart token.

A later visitor can therefore receive a cached response belonging to someone else, even without a login or session token. The record lists possible exposure of billing and shipping names, addresses, email, phone, cart contents and totals. It also identifies live cart-session credentials and an order key, creating a possible path to cart or checkout-session misuse.

That is exposure of the information present in an affected cached response. It is not evidence that every customer record, payment-card number or administrator credential was disclosed.

The conditions matter. A store needs the vulnerable plugin, WooCommerce’s relevant responses and active REST caching through a working LiteSpeed cache deployment. The plugin’s official listing distinguishes server-level caching from optimization features that can run on other web servers. Merely finding the plugin installed does not establish that this exposure occurred.

LiteSpeed’s configuration documentation shows REST caching as ON by default. Its ordinary exclusions for Cart and Checkout web pages are separate from this API response problem.

Upgrade and remove old cached responses

7.9.2 contains the repair. LiteSpeed’s tagged WooCommerce integration adds a hard no-cache decision for Store API requests. Its release changelog dates that version to October 20 and notes protection for unvaried cart responses. The public disclosure is newer than the fix.

Use the current supported plugin release, at least 7.9.2, through the normal update process. The WordPress listing reviewed for this capture already lists 7.9.3, released November 3. Confirm the installed version after updating.

Then address stored responses. LiteSpeed documents Purge All - LSCache for entries belonging to the WordPress installation. Review any additional cache layers with the hosting provider. Changing how future responses are classified does not itself prove that every older shared copy has disappeared.

If updating must wait, turning Cache REST API OFF reduces the documented exposure path. Purge existing entries as part of that containment step. Treat this as temporary risk reduction, not a replacement for the repair.

Review exposure without collecting more customer data

Preserve available logs and configuration history before routine retention removes them. Establish when the vulnerable version, REST caching and relevant store traffic overlapped. Investigate indications of inappropriate shared responses or cart-session activity through the store’s normal response process.

Where testing is needed, use authorized test accounts and synthetic shopping data in a controlled environment. Do not validate the issue by retrieving real shoppers’ private information. A clean result after patching cannot establish what another visitor received earlier.

If evidence supports credential or personal-data exposure, determine affected sessions and records with the platform provider and follow the appropriate response obligations. Purging a cache cannot recall information already copied.

Caveat: Wordfence sells WordPress security products and supplied the vulnerability record; its advisory webpage was inaccessible here, so the repair was checked against LiteSpeed’s tagged source and documentation.