Read the docs
TI-2026-84134 Aliases CVE-2026-111464GHSA-8338-x748-jf52

WP Fastest Cache exposes activation credentials in cached responses

Priority LOW 27CWE-524Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The WP Fastest Cache plugin by emrevona for WordPress is affected in all versions up to and including 1.5.3. It caches the response of WordPress core's wp-activate.php without honoring no-store or no-cache headers, which exposes sensitive information (CWE-524). An unauthenticated attacker can read the plaintext username and password of the most recently activated Multisite registrant from a publicly accessible cache file, but only on a Multisite subdirectory installation with public user and site registration enabled, after a genuine registrant follows their activation link.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00417 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
emrevonaWP Fastest Cache – WordPress Cache Pluginup to 1.5.3—No fix listedCNA
  • WP Fastest Cache – WordPress Cache Plugin Vendoremrevona Affected up to 1.5.3 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:*:*:*——emrevona
  • cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:*:*:* Versions — — ·emrevona

Remediation

The sources list no fixed version for WP Fastest Cache.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-111464
  2. 2026-11-03 Alias added: GHSA-8338-x748-jf52
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 7

  • TI-2023-01821 WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF CVSS 3.1HIGH 8.8
  • TI-2021-07151 WP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection CVSS 3.1HIGH 8.8
  • TI-2023-05581 WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
  • TI-2020-18971 WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion CVSS 3.1HIGH 8.1
  • TI-2019-10245 The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and… CVSS 3.0CRITICAL 9.1
  • TI-2021-07152 WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.1
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences