CVE-2026-74916: WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. No privileges or user interaction are required.
Which installations are affected?
WP Fastest Cache versions before 1.5.1 are affected; the stated affected range is 0.8.7.7 through 1.5.0. The issue applies when the plugin caches pages requested with the relevant tracking-related query parameters without incorporating those parameters into the cache key.
What is the practical impact of a successful attack?
An attacker can cause a page generated under their request context to be stored under the clean URL's cache entry. Subsequent visitors to that clean URL may then receive the poisoned cached response, with low confidentiality and integrity impact.
What should be done if patching cannot happen immediately?
The provided information does not identify a specific workaround. Prioritize upgrading to version 1.5.1 or later, and review or purge existing page-cache entries after remediation.