Medium severity4.3NVD Advisory· Published Mar 4, 2026· Updated Mar 31, 2026
CVE-2026-3058
CVE-2026-3058
Description
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the seraph_accel_api AJAX action with fn=GetData. This is due to the OnAdminApi_GetData() function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled task information, and external database state.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:s-sols:seraphinite_accelerator:*:*:*:*:*:wordpress:*:*Range: <2.28.15
- Range: <=2.28.14
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/changeset/3468084/seraphinite-accelerator/trunk/main.phpnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/bf539c01-596a-44dd-9587-6be6978ab0fanvdThird Party Advisory
- plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/Cmn/Plugin.phpnvdProduct
- plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/main.phpnvdProduct
News mentions
0No linked articles in our index yet.