CVE-2026-111464
MediumCVSS 5.9Summary
The WP Fastest Cache plugin for WordPress in versions up to and including 1.5.3 is vulnerable to Sensitive Information Exposure. The plugin caches the response of wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This allows unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached response.
Risk Assessment
An attacker can obtain the credentials of a newly registered Multisite user, potentially leading to account takeover and unauthorized access to the WordPress installation. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and a genuine registrant must follow their activation link.
Recommendation
Update the WP Fastest Cache plugin to a version later than 1.5.3 that fixes the vulnerability. If updating is not possible, consider disabling caching for wp-activate.php or restricting public registration in Multisite.
Other vulnerabilities in WP Fastest Cache
See all- CVE-2026-74916Medium
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
- CVE-2026-19760High
The WP Fastest Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This requires the Polylang or Polylang Pro plugin to be active and the Combine JS option enabled.
- CVE-2026-74932High
The WP Fastest Cache WordPress plugin before version 1.5.1 does not validate the Host header before using it to build URLs of asset files embedded in cached pages and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.
- CVE-2025-10476Medium
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_db_fix_callback() function. This affects all versions up to and including 1.4.0 and only sites with premium activated.
Original NVD description (English source)
The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS