CVE-2026-19253: Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to its public cache-clearing hook.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cache Enabler WordPress pluginto a version that resolves this vulnerability.Fixed in 1.8.17
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
Exposure requires Cache Enabler before 1.8.17 and either another installed vulnerable Cache Enabler plugin before 1.8.17 or code that passes a request-derived URL to the plugin’s public cache-clearing hook. The issue is not described as affecting every installation by default.
What does an attacker need to exploit this issue?
The attacker does not need authentication or user interaction. They need a reachable path in which a request-derived URL is passed to the public cache-clearing hook, allowing the URL-derived filesystem path to be used for deletion.
What is the potential impact?
An attacker may delete arbitrary files and directories because the cache purge routine does not validate the URL or restrict deletion to the cache directory. The supplied CVSS vector indicates high integrity and availability impact, with no confidentiality impact.
How can I determine whether my site is affected?
Check whether the KeyCDN Cache Enabler WordPress plugin is installed at a version earlier than 1.8.17. Also identify whether another vulnerable Cache Enabler plugin is installed or whether site code passes request-derived URLs to Cache Enabler’s public cache-clearing hook.