CVE-2026-104021
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
The Fastcache by Host.it plugin up to version 1.7.4 is vulnerable to Code Injection via the `fastcache_settings[cache_cookie_exclude][]` parameter. The setting is registered without a sanitize_callback, and the buildSiteHtaccessRules() function only applies trim() to cookie values before interpolating them into an Apache RewriteCond line, leaving embedded newlines intact. This allows authenticated administrators to inject arbitrary Apache directives into .htaccess, such as php_value auto_prepend_file, enabling execution of attacker-controlled PHP code on every request.
Risk Assessment
An administrator (or someone with admin access) can change server configuration, potentially leading to execution of malicious code on every page and full server compromise.
Recommendation
Update the plugin to a patched version. If not available, restrict access to plugin settings to trusted administrators only and manually inspect the .htaccess file.
Other vulnerabilities in Fastcache by Host.it
Original NVD description (English source)
The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache_settings[cache_cookie_exclude][]` parameter. This is due to the plugin registering the `cache_cookie_exclude` setting via `register_setting()` without a `sanitize_callback`, while `buildSiteHtaccessRules()` applies only `trim()` to each cookie value before interpolating it directly into an Apache `RewriteCond` line — a normalization that strips surrounding whitespace but leaves embedded newlines intact, allowing an attacker to break out of the capture group and append arbitrary directives. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary Apache directives into the site's `.htaccess` file via `file_put_contents()`, enabling server-level configuration changes such as setting `php_value auto_prepend_file` to execute attacker-controlled PHP code on every request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS