WP Super Cache <= 3.1.4 - Unauthenticated Web Cache Poisoning via Host Header
- ID
- WPSEC-2026-2405
- Plugin
- WP Super Cache (wp-super-cache)
- Affected
- all versions before 3.1.5
- Remediation
- Update to 3.1.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-03
- Attack surface
- WP Super Cache on WPSec AttackSurface
- Fix released
- Published
Description
The WP Super Cache plugin for WordPress is vulnerable to Web Cache Poisoning via the HTTP Host header in all versions up to, and including, 3.1.4. This is due to insufficient validation of the Host header. The plugin builds the supercache directory from the Host header, keeping everything before the first colon, so a Host value containing a path names another page's cache directory. It also puts the Host header in front of the request URI to detect query strings, and a malformed port makes that parsing fail, so query-string requests are treated as plain page requests. This makes it possible for unauthenticated attackers to replace the cached copy of another page with the content of a different page or of a query-string variant, which is then served to other visitors. Exploitation requires caching to be enabled, the target page to have no fresh cached copy, and the web server to pass the malformed Host header through to PHP.
References
- https://wpsec.com/vuln/WPSEC-2026-2405/
- https://plugins.svn.wordpress.org/wp-super-cache/tags/3.1.5/
- https://wordpress.org/plugins/wp-super-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS