6.5
Medium
CVE-2026-74916 The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its…
Description
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WP Fastest Cache 0.8 | 0.8.7.7 → < 1.5.1 | 1.5.1 |
Other CVEs of WP Fastest Cache
The 6 CVEs of WP Fastest Cache →
CVE-2026-74932
The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs…
7.5
High
CVE-2021-24870
The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action,…
6.1
Medium
CVE-2021-24869
The WP Fastest Cache WordPress plugin before 0.9.5 does not escape user input in the set_urls_with_terms method before…
8.8
High
CVE-2023-6063
The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it…
Not rated