CVE-2026-3058

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.28.14 via the `seraph_accel_api` AJAX action with `fn=GetData`. This is due to the `OnAdminApi_GetData()` function not performing any capability checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive operational data including cache status, scheduled task information, and external database state.

• CWE-200

• https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/Cmn/Plugin.php#L598Product
• https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/main.php#L2288Product
• https://plugins.trac.wordpress.org/changeset/3468084/seraphinite-accelerator/trunk/main.php?contextall=1Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bf539c01-596a-44dd-9587-6be6978ab0fa?source=cveThird Party Advisory

Published

Mar 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30573A Business Logic vulnerability exists in SourceCodester Phar…7.5
• CVE-2026-30574A Business Logic vulnerability exists in SourceCodester Phar…7.5
• CVE-2026-30575A Business Logic vulnerability exists in SourceCodester Phar…7.5
• CVE-2026-30576A Business Logic vulnerability exists in SourceCodester Phar…7.5
• CVE-2026-30578File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (X…6.5
• CVE-2026-30579File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XS…6.5
• CVE-2026-30580File Thingie 2.5.7 is vulnerable to Directory Traversal. A m…4.3
• CVE-2026-30586Cross Site Scripting vulnerability in usememos Memos v.0.26.…6.1
• CVE-2026-30587Multiple Stored XSS vulnerabilities exist in Seafile Server …8.7
• CVE-2026-3059SGLang's multimodal generation module is vulnerable to unaut…9.8
• CVE-2026-3060SGLang' encoder parallel disaggregation system is vulnerable…9.8
• CVE-2026-30603An issue in the firmware update mechanism of Qianniao QN-L23…6.8