{
 "id": "WPSEC-2026-2405",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2405/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2405/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2405/index.md",
 "title": "WP Super Cache <= 3.1.4 - Unauthenticated Web Cache Poisoning via Host Header",
 "description": "The WP Super Cache plugin for WordPress is vulnerable to Web Cache Poisoning via the HTTP Host header in all versions up to, and including, 3.1.4. This is due to insufficient validation of the Host header. The plugin builds the supercache directory from the Host header, keeping everything before the first colon, so a Host value containing a path names another page's cache directory. It also puts the Host header in front of the request URI to detect query strings, and a malformed port makes that parsing fail, so query-string requests are treated as plain page requests. This makes it possible for unauthenticated attackers to replace the cached copy of another page with the content of a different page or of a query-string variant, which is then served to other visitors. Exploitation requires caching to be enabled, the target page to have no fresh cached copy, and the web server to pass the malformed Host header through to PHP.",
 "plugin": {
  "slug": "wp-super-cache",
  "name": "WP Super Cache",
  "full_name": "WP Super Cache",
  "wordpress_org": "https://wordpress.org/plugins/wp-super-cache/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-super-cache/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-super-cache"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.5",
 "remediation": "Update to 3.1.5 or later.",
 "fix_released": "2026-11-02T15:14:11+00:00",
 "published": "2026-11-03T15:50:58+00:00",
 "updated": "2026-11-03T13:38:10.523884+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2405/",
  "https://plugins.svn.wordpress.org/wp-super-cache/tags/3.1.5/",
  "https://wordpress.org/plugins/wp-super-cache/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-super-cache",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-11-03"
 }
}