# Fast Index <= 2.2 - Cross-Site Request Forgery to Arbitrary File Upload, Settings Update and Service Account Key Deletion

- **ID:** WPSEC-2026-1122
- **Plugin:** Fast Index for Google Indexing API (`fast-index`), https://wordpress.org/plugins/fast-index/
- **Affected versions:** all versions before 3.0.0
- **Fixed in:** 3.0.0 (Update to 3.0.0 or later.)
- **Severity:** High 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fast-index
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1122/

## Description

The Fast Index for Google Indexing API plugin for WordPress is vulnerable to Cross-Site Request Forgery via the settings page in all versions up to, and including, 2.2, due to missing nonce validation in the settingsPage() function, which saves settings, uploads service account files and deletes stored keys. The upload routine also defines ALLOW_UNFILTERED_UPLOADS and trusts the browser-supplied file type. This makes it possible for unauthenticated attackers to upload arbitrary files (including PHP files, which may allow remote code execution), change the plugin's settings, or delete stored Google service account keys via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1122/
- https://plugins.svn.wordpress.org/fast-index/tags/3.0.0/
- https://wordpress.org/plugins/fast-index/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1122/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.