Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

SpeedyCache allows anyone to read commenters’ names and emails

CVE-2026-104006 · published 8 days ago
Summary

The SpeedyCache plugin for WordPress stores the name and email that returning visitors type into comment forms in its public cache. Because the cache is written without checking who is viewing it, anyone on the internet can request the same page and see that personal information. Update the plugin to the latest version or disable caching of pages that contain comment fields until the fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
softaculous speedycache – cache, optimization, performance <= 1.4.2
Original advisory text
SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check
The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-524Use of Cache Containing Sensitive Information
Timeline
Published10 Oct 2026
Updated16 Oct 2026
First seen10 Oct 2026
Sources
CVE-2026-104006 · NVD
CVE-2026-104006 · MITRE
Track software like this
Free during beta