Another busy stretch for WordPress security. On 4 November 2026 details went public for a high-severity flaw in LiteSpeed Cache, one of the most widely used WordPress plugins, that can leak WooCommerce customer details from the page cache. The same week brought a privilege-escalation fix for GiveWP, and active attacks against an unpatched crypto payment plugin that should be removed, not updated.
If you run a shop or take donations on WordPress, this one is worth a few minutes of your time. It follows last week’s round-up of WordPress 7.1.4 and form-plugin flaws, so if you have not applied those updates yet, do those as well.
LiteSpeed Cache: customer data left in the cache
LiteSpeed Cache has roughly seven million active installations. Wordfence and the LiteSpeed blog describe CVE-2026-93389, rated 8.2 out of 10. It affects versions up to and including 7.9.1. The fix is version 7.9.2 or later.
In plain English: with Cache REST API left on (the default), LiteSpeed was caching personalised WooCommerce Store API responses for the cart and checkout. Those cached responses could then be served to someone else who had no cookies and no cart token. That other visitor could see another shopper’s name, address, email, phone number, cart contents and a live cart session token. No login was needed.
It only bites shops that use WooCommerce cart and checkout, and only after at least one real shopper has used them. Still, that covers a huge number of UK small-business sites that rely on LiteSpeed hosting or the LiteSpeed Cache plugin for speed.
What to do: in Plugins, update LiteSpeed Cache to 7.9.2 or newer. If you cannot update straight away, turn Cache REST API off under LiteSpeed Cache → Cache until you can. After updating, purge the LiteSpeed cache so any old cart or checkout responses are cleared.
GiveWP: donation managers could raise donor roles
GiveWP is a popular donation and fundraising plugin. CVE-2026-118193, rated 8.8, affects versions up to and including 4.19.1. The patched release is 4.19.1.1.
Someone with the GiveWP Manager role (or higher) could configure donor registration so that new donor accounts were given elevated WordPress roles. Through the settings import path, that could even include Administrator. That is not a random visitor exploit, but it is a serious privilege-escalation bug if anyone with Give Manager access is compromised or untrusted.
Update GiveWP to 4.19.1.1 or later, then check the default role assigned to new donors and any recent imports of GiveWP settings. If donors were wrongly given Editor, Author or Administrator accounts, fix those roles now.
CryptoPayment Gateway: no patch, remove it
The Hacker News reports that attackers are actively probing CVE-2026-81648 in the CryptoPayment Gateway WordPress plugin. It is rated 10.0. Versions 1.2.1 to 1.2.2 (the latest) let unauthenticated users hit an AJAX endpoint that can delete files, overwrite the gateway config and recover stored wallet credentials in clear text.
There is no fix. The plugin was closed on the WordPress Plugin Directory in August 2026 for a security issue. If you have it installed, deactivate and delete it, rotate any wallet keys that were stored in the plugin, and check the site for unexpected file changes. Do not wait for an update that may never come.
Other plugins to check this week
Security researchers also disclosed high-severity issues in Import and export users and customers, Motors (car dealership listings) and GetPaid around the same time. GetPaid has a fix in 2.8.63 or later; for the others, open Plugins, compare your installed version with the latest available update, and apply anything offered. If a plugin is unused, remove it rather than leaving an old copy on the server.
None of this replaces the basics from earlier posts: keep WordPress itself current (see the October Bricksforge and UpdraftCentral notes), and remember that server-side PHP flaws such as those covered in my PHP2Shell write-up still matter even when your plugins look fine.
A short checklist
- Update LiteSpeed Cache to 7.9.2+ and purge the cache (especially on WooCommerce sites).
- Update GiveWP to 4.19.1.1+ and review the donor default role.
- Remove CryptoPayment Gateway if present; rotate wallet keys.
- Check for updates on Import and export users and customers, Motors and GetPaid (2.8.63+).
- Take a fresh backup before you update, then smoke-test the cart, checkout and donation forms afterwards.
Sources
- LiteSpeed: security update for LSCWP (CVE-2026-93389)
- Wordfence: LiteSpeed Cache sensitive information disclosure
- Wordfence: GiveWP privilege escalation
- The Hacker News: CryptoPayment Gateway CVE-2026-81648 under attack
- Centoculus: WordPress plugin vulnerabilities, 5 November 2026
Need help?
I look after WordPress sites for small businesses in Milton Keynes and across the UK, including updates, backups and security checks. If you’re not sure whether LiteSpeed Cache, GiveWP or another plugin on your site is affected, get in touch and I’ll take a look.
