WP Fastest Cache, CVE-2026-111464

CVE, Research URL: CVE-2026-111464
Home page URL: Security reports for WP Fastest Cache
Application: WP Fastest Cache
Published on: Nov 03, 2026
Research Description: The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.
Affected versions: max 1.5.4.
Status: vulnerable