CVE-2026-74916— WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
Quick assessment
Affected
Unknown WP Fastest Cache
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WP Fastest Cache WordPress 插件在 1.5.1 版本之前，其页面缓存键中未包含一组与追踪相关的查询参数，但仍在存在这些参数时缓存页面。这使得未认证的 attackers 能够令页面在其自身的请求上下文中渲染，并将其存储于干净 URL 的缓存条目下，从而向后续所有访客提供该页面。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74916
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Fastest Cache | 0.8.7.7 ~ 1.5.1 | - |
|
II. Public POCs for CVE-2026-74916
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74916
请登录查看更多情报信息。
Other References for CVE-2026-74916 (1)
-
🔗 WP Fastest Cache 0.8.7.7 – 1.5.0 – Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters | CVE 2026-74916 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-01 · 3 CVEs total
| CVE-2026-13611 | 5.3 MEDIUM | KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data |
| CVE-2026-78363 | 4.8 MEDIUM | MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message |
IV. Related Vulnerabilities
Same product: WP Fastest Cache
-
CVE-2026-74932
WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XS -
CVE-2021-24869
WP Fastest Cache < 0.9.5 - Subscriber+ SQL Injection -
CVE-2021-24870
WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripti -
CVE-2023-6063
WP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection -
CVE-2023-1938
WP Fatest Cache < 1.1.5 - Blind SSRF via CSRF
Same vendor: Unknown
-
CVE-2026-13611
KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 -
CVE-2026-78363
MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Exe -
CVE-2026-77013
Icollect <= 1.0.0 - Unauthenticated User and Term Creation v -
CVE-2026-81660
Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web For -
CVE-2026-81766
Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Ar
V. Comments for CVE-2026-74916
No comments yet