Executive brief
The APCu Manager plugin for WordPress, which helps manage website performance through caching, contains a security flaw that allows attackers to inject malicious scripts. By sending a specially crafted request to the website, an attacker can store a malicious script that executes when a site administrator views the plugin's management page. This could lead to the unauthorized takeover of the administrator's account or the entire website.
Technical details
The APCu Manager plugin fails to properly escape APCu object-cache keys before rendering them within the administrative dashboard. An unauthenticated attacker can trigger the creation of a cache key containing malicious JavaScript (e.g., via a transient name or other unsanitized input processed by the plugin or associated components). When a persistent object cache is enabled and an administrator views the affected admin-area page, the malicious payload executes in their browser context. This allows for session hijacking, unauthorized administrative actions, or full site compromise. The issue is fixed in version 4.5.0.
Affected products
- Unknown APCu Manager < 4.5.0
Timeline
- 2026-06-08: disclosed: Publicly published by WPScan
- 2026-06-29: advisory: NVD publication date
- 2026-06-29: patched: Fixed in version 4.5.0