Executive brief
WP Fastest Cache is a WordPress plugin that accelerates website performance by caching pages. The plugin fails to include tracking-related URL parameters (like utm_source) in its cache key, allowing attackers to poison the cache by requesting pages with malicious parameter values. Subsequent visitors receive the poisoned cached version, potentially including injected scripts that could steal data or compromise user accounts.
Technical details
The vulnerability is a cache poisoning flaw caused by incomplete cache-key generation in WP Fastest Cache versions 0.8.7.7 through 1.5.0. The plugin excludes tracking-related query parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, fbclid, and others) from its page-cache key while still caching pages requested with these parameters. An unauthenticated attacker can request a page with malicious parameter values, which gets cached under the clean URL's cache entry. All subsequent visitors to that URL are served the poisoned cache. If the site theme or another plugin reflects these parameters into the page without proper escaping, the attack escalates to stored cross-site scripting (XSS). The attack requires only that the cache be enabled; no authentication is needed. The fix was released in version 1.5.1.
Affected products
- WP Fastest Cache WP Fastest Cache 0.8.7.7 through 1.5.0
Timeline
- 2026-08-26: disclosed
- 2026-09-01: patched: Fixed in version 1.5.1