Security Alert Summary
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them. This can allow an unauthenticated attacker to have a page rendered under their request context stored under the clean URL’s cache entry and served to subsequent visitors.
CVE Details
- CVE ID: CVE-2026-74916
- Affected component: WP Fastest Cache WordPress plugin
- Affected versions: Versions before 1.5.1 (example: 0.8.7.7)
- Published: September 1, 2026 at 8:17:01 AM UTC
- Last modified: September 1, 2026 at 1:19:58 PM UTC
- CVSS v3.1: Base score 6.5; severity MEDIUM; vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Authentication/Privileges/User interaction: Authentication required: None; Privileges required: None; User interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-349
Technical Details
The plugin fails to include certain tracking-related query parameters when constructing the page-cache key, but it still caches pages that were requested with those parameters. As a result, an unauthenticated attacker can cause a page that was rendered with their request context to be stored under the clean URL’s cache entry.
Because the cache entry for the clean URL can be overwritten by a request that included those tracking parameters, subsequent visitors may receive the cached response that reflects the attacker-controlled request context rather than a canonical clean-page response. The description does not name specific functions or REST endpoints.
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner, internal staff who publish content, and external contractors who contribute or test pages. If an attacker is able to poison a cache entry as described, pages served to regular visitors could reflect the attacker-controlled rendering. Practical consequences may include exposure of content or data tied to the attacker request context and an increased risk of targeted phishing or social engineering if attacker-controlled content is cached and shown to other users.
The issue is limited to pages cached under the affected conditions and does not by itself imply full site compromise, but it can affect the integrity and confidentiality of what is displayed to visitors. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and cache behavior for unusual changes or unexpected cached content.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
