# WP Fastest Cache <= 1.5.4 - Authenticated (Author+) Path Traversal to Arbitrary Directory Deletion via Post Permalink

- **ID:** WPSEC-2026-2678
- **Plugin:** WP Fastest Cache – WordPress Cache Plugin (`wp-fastest-cache`), https://wordpress.org/plugins/wp-fastest-cache/
- **Affected versions:** all versions before 1.5.5
- **Fixed in:** 1.5.5 (Update to 1.5.5 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-fastest-cache
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2678/

## Description

The WP Fastest Cache plugin for WordPress is vulnerable to Path Traversal leading to arbitrary directory deletion in all versions up to, and including, 1.5.4. This is due to insufficient validation of cache paths in the singleDeleteCache() and delete_next_prev_cache() functions. These functions URL-decode a post's permalink and append it to the cache directory before recursively deleting or moving the resulting path, with no check for '../' sequences. This makes it possible for authenticated attackers with Author-level access and above to craft a percent-encoded post slug that decodes to directory traversal sequences, and have directories outside the cache folder deleted or moved when the post's cache is cleared. Removing such directories can break the site or lead to further compromise.

## References

- https://wpsec.com/vuln/WPSEC-2026-2678/
- https://plugins.svn.wordpress.org/wp-fastest-cache/tags/1.5.5/
- https://wordpress.org/plugins/wp-fastest-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2678/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.