Security Alert Summary
The Seraphinite Accelerator plugin for WordPress contains a missing capability check that affects the seraph_accel_api AJAX action when invoked with fn=LogClear. Authenticated users with Subscriber-level access and above can clear the plugin’s debug/operational logs, removing records that may be useful for debugging or incident investigation.
CVE Details
- CVE ID: CVE-2026-3056
- Affected plugin / component: Seraphinite Accelerator plugin for WordPress
- Affected versions: All versions up to and including 2.28.14
- Published: March 4, 2026 12:16 PM UTC
- Last modified: March 4, 2026 12:16 PM UTC
- CVSS v3.1: Base score 4.3 — MEDIUM; Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User interaction: Authentication required: Yes (authenticated users). Privileges required: Low (PR:L). User interaction: None (UI:N). The CVE description specifies that authenticated users with Subscriber-level access and above can trigger the issue.
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness ID: CWE-862
Technical Details
This vulnerability is a missing capability check on the plugin’s AJAX endpoint. Specifically, the seraph_accel_api AJAX action when called with the parameter fn=LogClear does not verify that the invoking user has the appropriate capability to clear the plugin’s logs. Because the check is absent, any authenticated user meeting the low privilege requirement (Subscriber and above, as described) can invoke the action and clear the plugin’s debug/operational logs.
The impact is limited to modification of the plugin’s log data (integrity impact). The vulnerability does not indicate direct confidentiality loss or denial of service based on the provided data.
How This Could Impact Your Website
Consider a site with multiple user roles: a site owner, internal staff (editors/contributors), and external contractors or contributors who have subscriber-level accounts. If a subscriber or a compromised account with similar privileges invokes the vulnerable AJAX action, plugin logs that record errors, operational messages, or security-relevant events could be deleted. This removal of logs can:
- Hinder debugging of plugin or site issues, delaying repairs.
- Obscure evidence of suspicious activity, making incident investigation and attribution more difficult.
- Indirectly increase the chance that follow-up malicious actions go unnoticed for longer, as log trails that would normally aid detection are missing.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially Contributor and Subscriber accounts that are not required.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and plugin logs for unusual behavior; maintain external log backups where practical so records are available even if local logs are cleared.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/Cmn/Plugin.php#L598
- https://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/main.php#L2459
- https://plugins.trac.wordpress.org/changeset/3468084/seraphinite-accelerator/trunk/main.php?contextall=1
- https://www.wordfence.com/threat-intel/vulnerabilities/id/96850eb6-77d8-4012-b360-a417918cab0e?source=cve
