Read the docs
TI-2020-18971 Aliases CVE-2020-36836GHSA-g4xm-rx7f-2jj3

WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

Priority HIGH 70CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01491 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed WP Fastest Cache – WordPress Cache Plugin (emrevona): 0.9.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
emrevonaWP Fastest Cache – WordPress Cache Pluginbefore 0.9.0.30.9.0.3Patch availableCNA
  • WP Fastest Cache – WordPress Cache Plugin Vendoremrevona Affected before 0.9.0.3 Fixed in 0.9.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:*before 0.9.0.3Vulnerableemrevona
  • cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:* Versions before 0.9.0.3 Vulnerable ·emrevona

Remediation

  • Fix · CNA WP Fastest Cache – WordPress Cache Plugin (emrevona) Fixed in 0.9.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-36836
  2. 2026-10-03 Alias added: GHSA-g4xm-rx7f-2jj3

References

Exploit 1

Patch 1

Advisory 1

  • TI-2023-01821 WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF CVSS 3.1HIGH 8.8
  • TI-2021-07151 WP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection CVSS 3.1HIGH 8.8
  • TI-2023-05581 WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
  • TI-2019-10245 The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and… CVSS 3.0CRITICAL 9.1
  • TI-2021-07152 WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2015-07693 The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in… CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences