LiteSpeed Cache 7.9.2 fixes a WooCommerce data leak: update

If your WordPress shop runs LiteSpeed Cache with WooCommerce, update the plugin to 7.9.2 or later. Patchstack reports that versions up to 7.9.1 could let visitors who are not logged in see cart and checkout data from WooCommerce, and scores it 7.5 out of 10. The fix is out, and the latest version is 7.9.3.

What is the problem?

Patchstack lists it as a sensitive data exposure (CVE-2026-93389) in LiteSpeed Cache 7.9.1 and older, fixed in 7.9.2. The plugin's own change log for 7.9.2, released 20 October 2026, says it made WooCommerce nonce fragments private by default and protected cart responses. Patchstack marks it low priority and unlikely to be exploited, but customer details at checkout are personal data, so it is worth a few minutes.

WordPress.org lists LiteSpeed Cache on more than 7 million sites, so many WooCommerce shops will have it.

Who is affected?

• WordPress sites with LiteSpeed Cache 7.9.1 or older, and
• WooCommerce switched on.

Sites without WooCommerce should still update, since 7.9.2 and 7.9.3 also include other hardening and fixes.

What to do

1. Take a backup of the site and database first.
2. In WP Admin, go to Plugins, then Installed Plugins, and find LiteSpeed Cache. Check the version number.
3. If it shows 7.9.1 or lower, click Update now. Version 7.9.3 is the latest at the time of writing.
4. After updating, open the shop as a visitor, add something to the cart, and go through to the checkout page to make sure it works.
5. Clear the LiteSpeed cache once from the LiteSpeed Cache menu in WP Admin.
6. Do the same on any staging or test copies of the site.

If you think customer data may already have been seen by someone it should not have, talk to your developer and read up on your duties under the PDPA.

How SyncTech can help

Plugin updates like this are easy to miss. Our WordPress website care plans include plugin updates with a backup first and a checkout test after. Questions about your own site? Reach us through the SyncTech help centre.

Source and credit

We are sharing this news from Patchstack and the WordPress.org plugin directory. This summary is written by Synctech in our own words.

• LiteSpeed Cache 7.9.1 sensitive data exposure, Patchstack, 4 November 2026: https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-7-9-1-unauthenticated-sensitive-information-disclosure-woocommerce-store-api-cart-checkout-pii-cart-token-vulnerability
• LiteSpeed Cache plugin page and change log, WordPress.org, retrieved 5 November 2026: https://wordpress.org/plugins/litespeed-cache/ Retrieved 5 November 2026. WordPress, WooCommerce and LiteSpeed are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.