CVE-2026-104006

The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.

• CWE-524

• https://plugins.trac.wordpress.org/browser/speedycache/tags/1.4.2/main/advanced-cache.php#L108
• https://plugins.trac.wordpress.org/browser/speedycache/tags/1.4.2/main/cache.php#L151
• https://plugins.trac.wordpress.org/browser/speedycache/tags/1.4.2/main/cache.php#L214
• https://plugins.trac.wordpress.org/browser/speedycache/tags/1.4.2/main/cache.php#L91
• https://plugins.trac.wordpress.org/changeset/3734608/speedycache/trunk/main/cache.php
• https://plugins.trac.wordpress.org/changeset/3734609/speedycache
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c6b8d5ca-34e2-4d25-9185-7fcee790379d?source=cve

Published

Oct 10, 2026

Last Modified

Oct 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103956Missing authentication for critical function in the authenti…10
• CVE-2026-103957Server-side request forgery in the OAuth2 discovery handling…6.2
• CVE-2026-103958Server-side request forgery in the tool server and remote ag…7.6
• CVE-2026-103964The Download Manager plugin for WordPress is vulnerable to S…4.3
• CVE-2026-103998The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contac…6.1
• CVE-2026-104002A fail-open error handling issue within the data masking uti…5.3
• CVE-2026-104018An improper privilege management vulnerability (CWE-269) exi…8.8
• CVE-2026-104019OS command injection in the Studio Space startup validation …9
• CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion Pytho…7.5
• CVE-2026-104021The Fastcache by Host.it plugin for WordPress is vulnerable …7.2
• CVE-2026-104022The Academy LMS – AI Course Builder, Quizzes, Certificates &…5.4
• CVE-2026-104023The Smart Popup by Supsystic plugin for WordPress is vulnera…4.9