The Seraphinite Accelerator plugin for WordPress allows the seraph_accel_api AJAX action to return sensitive operational data. Because the OnAdminApi_GetData() function does not verify user capabilities, any authenticated user with the Subscriber role or higher may call the fn=GetData endpoint. Exposure includes cache status, scheduled task information, and external database state, potentially revealing valuable operational details. The weakness is a lack of access control and is reflected in CWE‑200.

The plugin sent by Seraphinite Soft, Seraphinite Accelerator, is affected. Versions up to and including 2.28.14 on WordPress installations are vulnerable. Administrators should check the plugin version and update to a later release.

The CVSS base score is 4.3, placing the vulnerability in the medium range. Exploit probability, as measured by EPSS, is reported as less than 1 percent, and the issue is not listed in the CISA KEV catalog. Nonetheless, any user with Subscriber level credentials on a WordPress site can use the exposed AJAX endpoint to read operational data, giving an attacker insight into the system’s internals. Because the attack requires only authentication to the site, the attack vector is a legitimate user account, making the risk moderate but significant for environments where exposure of such data would be sensitive.