Executive brief
The Aruba HiSpeed Cache plugin for WordPress, which is used to improve website performance through caching, contains a security flaw that allows attackers to reset the plugin's settings. By tricking a site administrator into clicking a malicious link or visiting a compromised page, an attacker can force the website to revert all plugin configurations to their default values. This could disrupt site performance and undo custom security or optimization settings configured by the administrator.
Technical details
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce verification on the ahsc_ajax_reset_options() function. This vulnerability affects all versions up to and including 3.0.4. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which triggers a forged request to the vulnerable AJAX endpoint. Successful exploitation allows the attacker to reset all of the plugin's settings to their default values. The issue has been addressed in version 3.0.5.
Affected products
- Aruba Aruba HiSpeed Cache Up to, and including, 3.0.4
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory
References
- https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.4/aruba-hispeed-cache.php
- https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.4/aruba-hispeed-cache.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Faruba-hispeed-cache/tags/3.0.4&new_path=%2Faruba-hispeed-cache/tags/3.0.5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d2230151-fde2-43d6-8bff-0d2ffd559ab3?source=cve