CVE-2026-17532: Seraphinite Accelerator XSS Vulnerability

CVE-2026-17532 Overview

The Seraphinite Accelerator plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 2.29.15. Unauthenticated attackers can inject arbitrary web scripts through the seraph_accel_prep parameter. The flaw combines an HMAC signature bypass caused by PHP loose comparison with insufficient output escaping in the response body. Successful exploitation requires a victim to click a crafted link, after which injected scripts execute in the victim's browser session. The vulnerability is tracked under CWE-79 and has an EPSS probability of 0.347%.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, credential harvesting, and administrative account takeover if an authenticated administrator is targeted.

Affected Products

Seraphinite Accelerator plugin for WordPress, versions up to and including 2.29.15
Vulnerable functions: CacheExtractPreparePageParams() and _CbContentFinishSkip()
Fixed in Seraphinite Accelerator version 2.29.18

Discovery Timeline

2026-08-05 - CVE-2026-17532 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-17532

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw resulting from two interacting weaknesses in the Seraphinite Accelerator plugin. The CacheExtractPreparePageParams() function validates a caller-supplied nonce against an expected HMAC value before invoking cache preparation logic. The check relies on PHP's loose inequality operator (!=), which performs type juggling before comparison. As a result, the signature check can be bypassed by supplying a JSON boolean rather than a string.

Once the signature check is bypassed, the request reaches the _CbContentFinishSkip() function. This function concatenates the attacker-controlled selfTest field directly into the HTML response body without escaping. The reflected input is returned to the requesting browser and executed in the DOM context of the vulnerable WordPress site.

Root Cause

The root cause is twofold. First, using != to compare an HMAC string against a JSON-decoded value allows PHP type coercion: comparing the boolean true against any non-empty string evaluates as loosely equal, defeating the integrity check. Second, _CbContentFinishSkip() writes the selfTest value directly into the HTML response without applying context-appropriate output escaping, violating standard XSS mitigation guidance in CWE-79.

Attack Vector

An unauthenticated attacker crafts a URL containing a JSON payload in the seraph_accel_prep parameter. The payload sets the nonce field to the JSON boolean true to bypass HMAC validation and places malicious script content in the selfTest field. The attacker delivers this link via phishing, social media, or a malicious page. When a victim clicks the link, the plugin reflects the selfTest content into the response, executing the injected script under the site's origin. Source code references are available in the WordPress Plugin Cache Ex Code and WordPress Plugin Common Code.

No verified public exploit code is available. See the Wordfence Vulnerability Analysis for additional technical details.

Detection Methods for CVE-2026-17532

Indicators of Compromise

HTTP requests containing the seraph_accel_prep query parameter with JSON payloads where the nonce field is set to the boolean true.
Requests containing <script>, javascript:, or event handler strings (for example onerror=, onload=) inside a selfTest JSON field.
Referrer chains showing users arriving at the WordPress site from external phishing domains prior to script execution in browser telemetry.

Detection Strategies

Inspect web server access logs for URLs containing seraph_accel_prep= combined with URL-encoded JSON structures and script-like substrings.
Deploy Web Application Firewall (WAF) rules that decode JSON parameter values and flag boolean values in fields expecting HMAC strings.
Correlate outbound browser requests to unfamiliar domains immediately following a WordPress page load containing the seraph_accel_prep parameter.

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress front-end servers and forward logs to a centralized analytics platform for parameter-level inspection.
Monitor endpoint browser processes for suspicious script execution and outbound connections following visits to WordPress properties running the Seraphinite Accelerator plugin.
Alert on plugin version fingerprints matching 2.29.15 or earlier discovered during external attack-surface scans.

How to Mitigate CVE-2026-17532

Immediate Actions Required

Upgrade the Seraphinite Accelerator plugin to version 2.29.18 or later on all WordPress instances.
Audit web server logs for prior requests containing the seraph_accel_prep parameter to identify possible exploitation attempts.
Force session invalidation and password resets for administrative users if suspicious requests are found in log review.

Patch Information

The vendor addressed the vulnerability in Seraphinite Accelerator version 2.29.18. The fix updates the affected comparison and output-handling logic. Patched source is available in the WordPress Changeset Cache Ex and WordPress Changeset Common Code. Compare against the fixed cache_ex.php and common.php in tag 2.29.18.

Workarounds

Deactivate the Seraphinite Accelerator plugin until the upgrade to 2.29.18 can be completed.
Deploy a WAF rule that blocks HTTP requests containing the seraph_accel_prep parameter or that reject JSON payloads where the nonce field is not a string.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of reflected script injection.

bash

# Example WAF rule (ModSecurity) blocking suspicious seraph_accel_prep payloads
SecRule ARGS:seraph_accel_prep "@rx (?:\"nonce\"\s*:\s*true|<script|javascript:|on\w+\s*=)" \
    "id:1017532,phase:2,deny,status:403,log,msg:'CVE-2026-17532 Seraphinite Accelerator XSS attempt'"