WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached Account Activation Page
- ID
- WPSEC-2026-2212
- Plugin
- WP Fastest Cache – WordPress Cache Plugin (wp-fastest-cache)
- Affected
- all versions before 1.5.4
- Remediation
- Update to 1.5.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-524
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- WP Fastest Cache on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-111464, on 2026-11-02.
Description
The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure via the page cache in all versions up to, and including, 1.5.3, due to the cache writer not excluding the multisite account activation page (wp-activate.php), requests carrying the wp-activate-* activation cookie, or responses that send Set-Cookie or Cache-Control: private/no-store/no-cache headers. A per-user response, such as the activation page showing a newly activated user's username and password, can therefore be saved as a static cache file and served to later visitors. This makes it possible for unauthenticated attackers to read other users' account credentials or other private content from the cache. Exploitation requires page caching to be enabled and depends on site configuration: for the activation case, the plugin must be loaded on a multisite network with user registration, and the permalink structure must not end with a slash.
References
- https://wpsec.com/vuln/WPSEC-2026-2212/
- https://plugins.svn.wordpress.org/wp-fastest-cache/tags/1.5.4/
- https://wordpress.org/plugins/wp-fastest-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS