# WP Super Cache <= 3.1.4 - Unauthenticated Web Cache Poisoning via Host Header

- **ID:** WPSEC-2026-2405
- **Plugin:** WP Super Cache (`wp-super-cache`), https://wordpress.org/plugins/wp-super-cache/
- **Affected versions:** all versions before 3.1.5
- **Fixed in:** 3.1.5 (Update to 3.1.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-super-cache
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2405/

## Description

The WP Super Cache plugin for WordPress is vulnerable to Web Cache Poisoning via the HTTP Host header in all versions up to, and including, 3.1.4. This is due to insufficient validation of the Host header. The plugin builds the supercache directory from the Host header, keeping everything before the first colon, so a Host value containing a path names another page's cache directory. It also puts the Host header in front of the request URI to detect query strings, and a malformed port makes that parsing fail, so query-string requests are treated as plain page requests. This makes it possible for unauthenticated attackers to replace the cached copy of another page with the content of a different page or of a query-string variant, which is then served to other visitors. Exploitation requires caching to be enabled, the target page to have no fresh cached copy, and the web server to pass the malformed Host header through to PHP.

## References

- https://wpsec.com/vuln/WPSEC-2026-2405/
- https://plugins.svn.wordpress.org/wp-super-cache/tags/3.1.5/
- https://wordpress.org/plugins/wp-super-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2405/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.