CVE-2026-107763: Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fastcache by Host.itto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. They can then add or remove Fastcache page-cache rewrite rules in the site root .htaccess file.
What impact should administrators expect?
The documented impact is modification of the plugin's page-cache rewrite rules, affecting integrity rather than confidentiality or availability. The vulnerability does not state that an attacker can write arbitrary .htaccess directives beyond those cache-related rules.
How can I determine whether my site may be affected?
Sites using Fastcache by Host.it version 1.7.5 or earlier may be affected, particularly if untrusted users can obtain Subscriber or higher WordPress roles. Review the root .htaccess file for unexpected additions or removals of the plugin's page-cache rewrite rules.