WP Fastest Cache <= 1.5.4 - Authenticated (Author+) Path Traversal to Arbitrary Directory Deletion via Post Permalink
- ID
- WPSEC-2026-2678
- Plugin
- WP Fastest Cache – WordPress Cache Plugin (wp-fastest-cache)
- Affected
- all versions before 1.5.5
- Remediation
- Update to 1.5.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- WP Fastest Cache on WPSec AttackSurface
- Fix released
- Published
Description
The WP Fastest Cache plugin for WordPress is vulnerable to Path Traversal leading to arbitrary directory deletion in all versions up to, and including, 1.5.4. This is due to insufficient validation of cache paths in the singleDeleteCache() and delete_next_prev_cache() functions. These functions URL-decode a post's permalink and append it to the cache directory before recursively deleting or moving the resulting path, with no check for '../' sequences. This makes it possible for authenticated attackers with Author-level access and above to craft a percent-encoded post slug that decodes to directory traversal sequences, and have directories outside the cache folder deleted or moved when the post's cache is cleared. Removing such directories can break the site or lead to further compromise.
References
- https://wpsec.com/vuln/WPSEC-2026-2678/
- https://plugins.svn.wordpress.org/wp-fastest-cache/tags/1.5.5/
- https://wordpress.org/plugins/wp-fastest-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS