# WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached Account Activation Page

- **ID:** WPSEC-2026-2212
- **Plugin:** WP Fastest Cache – WordPress Cache Plugin (`wp-fastest-cache`), https://wordpress.org/plugins/wp-fastest-cache/
- **Affected versions:** all versions before 1.5.4
- **Fixed in:** 1.5.4 (Update to 1.5.4 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-524
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-fastest-cache
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2212/

## Description

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure via the page cache in all versions up to, and including, 1.5.3, due to the cache writer not excluding the multisite account activation page (wp-activate.php), requests carrying the wp-activate-* activation cookie, or responses that send Set-Cookie or Cache-Control: private/no-store/no-cache headers. A per-user response, such as the activation page showing a newly activated user's username and password, can therefore be saved as a static cache file and served to later visitors. This makes it possible for unauthenticated attackers to read other users' account credentials or other private content from the cache. Exploitation requires page caching to be enabled and depends on site configuration: for the activation case, the plugin must be loaded on a multisite network with user registration, and the permalink structure must not end with a slash.

Also published later by wordfence as CVE-2026-111464.

## References

- https://wpsec.com/vuln/WPSEC-2026-2212/
- https://plugins.svn.wordpress.org/wp-fastest-cache/tags/1.5.4/
- https://wordpress.org/plugins/wp-fastest-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2212/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.