WordPress plugin vulnerabilities: 5 plugins, including LiteSpeed Cache

Vulnerabilities have been disclosed in five WordPress plugins. All of them are rated high, with CVSS scores between 7.1 and 8.8. The highest scores (8.8) apply to privilege escalation flaws in GiveWP and Import and export users and customers. The most widely used affected plugin is LiteSpeed Cache with about 7 million active installations, where unauthenticated visitors can read WooCommerce customer data from the cache.

GiveWP – Donation Plugin and Fundraising Platform (100,000 active installations)

GiveWP is affected by a privilege escalation flaw in all versions up to and including 4.19.1 (CVE-2026-118193, CVSS 8.8). Logged-in users with the GiveWP Manager role or above can configure donor registration so that new donor accounts receive elevated WordPress roles, up to Administrator via the settings import function. Update GiveWP to the latest version and review the default role assigned to new donors. If no update is available, deactivate and remove the plugin.

Import and export users and customers (70,000 active installations)

All versions up to and including 2.5.11 contain a privilege escalation flaw in the cron settings handling (CVE-2026-120554, CVSS 8.8). Logged-in users with a custom role that has the create_users capability, but not promote_users or edit_users, can escalate to Administrator under certain conditions involving a previously saved cron configuration. Update the plugin to the latest version, or deactivate and remove it if no update is available.

LiteSpeed Cache (7,000,000 active installations)

LiteSpeed Cache up to and including 7.9.1 can expose sensitive WooCommerce customer data to unauthenticated visitors (CVE-2026-93389, CVSS 8.2). With Cache REST enabled, which is the default, personalized cart and checkout responses from the WooCommerce Store API are cached publicly and served to other visitors, revealing billing and shipping details, cart contents and the shopper's session token, which can allow session hijacking. Sites running WooCommerce should update LiteSpeed Cache to the latest version; if no update is available, deactivate and remove the plugin.

Motors – Car Dealership & Classified Listings Plugin (9,000 active installations)

All versions up to and including 1.4.128 allow logged-in users with Subscriber-level access and above to delete image files of other users within wp-content/uploads, such as avatars, dealer logos and uploaded media (CVE-2026-116617, CVSS 8.1). Files outside the uploads directory and files without an image extension cannot be reached. Update the plugin to the latest version, or deactivate and remove it if no update is available.

GetPaid (5,000 active installations)

Two flaws affect GetPaid versions before 2.8.63. Unauthenticated visitors can submit a negative item quantity on a public payment form so that an invoice is marked as paid without any charge (CVE-2026-119749, CVSS 7.5). In addition, logged-in users with roles such as Editor or Author can use the REST API to list other users' invoices, mark pending invoices as paid or create items and invoices (CVE-2026-119747, CVSS 7.1). Update GetPaid to version 2.8.63 or later.

How to check your sites

In the WordPress dashboard, open Plugins and compare the installed versions of these plugins with the affected versions listed above, then install the available updates. With WP-CLI, run wp plugin list to see installed plugins, their versions and whether updates are available, and wp plugin update <plugin-slug> to update a single plugin. The slugs are give, import-users-from-csv-with-meta, litespeed-cache, motors-car-dealership-classified-listings and invoicing. Remove plugins that are no longer needed.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-116617
• https://nvd.nist.gov/vuln/detail/CVE-2026-118193