Executive brief
WP Fastest Cache is a popular WordPress plugin used to improve website performance through caching. The plugin fails to validate the Host header when building URLs for cached pages, allowing attackers to inject malicious scripts that execute for all subsequent visitors. An attacker can also target administrators by exploiting stale administrator lists, potentially compromising authenticated admin accounts and causing widespread website defacement or data theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) attack enabled by HTTP Host header cache poisoning (CWE-79). The root cause is that WP Fastest Cache does not validate or sanitize the Host header before using it to construct asset URLs embedded in cached pages, and does not include the Host header in the cache key. This allows unauthenticated attackers to send requests with a malicious Host header, poisoning the cached page with references to attacker-controlled servers. The injected JavaScript executes for every subsequent visitor. Additionally, the plugin's administrator exemption logic relies on a hardcoded list of admin usernames that is only refreshed during user registration or profile updates, so newly promoted administrators may be served poisoned cached pages with scripts running in their authenticated session. No user interaction is required beyond normal site browsing. The vulnerability affects versions 0.9.0.3 through 1.5.0 and is fixed in version 1.5.1.
Affected products
- WP Fastest Cache WP Fastest Cache 0.9.0.3 to 1.5.0
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in version 1.5.1