CVE-2026-104006: softaculous speedycache – cache, optimization, performance

Vulnerability summary

CVE-2026-104006 is a low (CVSS 3.7) vulnerability in softaculous speedycache – cache, optimization, performance. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.3% of scored vulnerabilities. Fixed in 1.4.3.

Timeline

1. 10-10-2026
   PublishedVulnerability first disclosed.
2. 11-10-2026
   Last modifiedVulnerability information updated.

Description

The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 via the 'comment_author_*, comment_author_email_*' parameter. This makes it possible for unauthenticated attackers to extract the full name and email address of returning commenters pre-filled into comment form input fields and persisted as the site-wide cached page by any unauthenticated attacker requesting the same public URL. The read-side handler in advanced-cache.php correctly skips cached delivery for requests carrying comment_author_* cookies, but this check is absent on the write path, meaning the cache poisoning is invisible to the victim commenter yet fully exploitable by any unauthenticated attacker with no cookies.

• CWE-524Use of Cache Containing Sensitive InformationThe code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.