Description

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-01T08:17:01.393Z",
  "pubdate": "2026-09-01T08:17:01.393Z",
  "executiveSummary": "The WP Fastest Cache WordPress plugin, in versions prior to 1.5.1, is susceptible to a Web Cache Poisoning vulnerability. This flaw arises from the improper handling of URL query parameters during the page caching process.\nSpecifically, the caching mechanism fails to account for certain tracking-related query parameters when generating unique keys for cached page entries. Consequently, pages requested with arbitrary query parameters are stored in the cache under the key associated with the clean (parameter-less) URL.\nThis allows an unauthenticated attacker to force the server to cache a representation of a page rendered under the attacker's own request context. Once stored, this poisoned entry is served to all subsequent visitors, potentially leading to unauthorized data exposure or unauthorized content delivery.\nThe impact includes the degradation of cache integrity and the potential for cross-user data leakage. Exploitation does not require authentication or elevated privileges, making it a significant risk for public-facing WordPress environments utilizing the plugin for performance optimization.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient normalization and cache-key generation logic within the WP Fastest Cache plugin's caching engine. The plugin fails to treat specific tracking-related query parameters as distinct request variations. When a page is requested with these parameters, the plugin generates a cache key that ignores these modifiers, effectively collapsing distinct requests into a single canonical cache entry.\nThe attack flow proceeds as follows: 1) An unauthenticated attacker crafts a malicious request containing specific tracking query parameters intended to trigger the generation of a page variant or reveal sensitive information based on the request context. 2) The WP Fastest Cache plugin processes this request, renders the page, and incorrectly associates the resulting output with the clean, base URL cache entry. 3) The plugin writes this response to the cache storage directory, overwriting the legitimate 'clean' version of the page. 4) All subsequent users requesting the base URL without parameters are served the attacker-influenced page currently residing in the cache.\nBecause the caching mechanism does not distinguish between these requests, the poisoned cache entry persists until the cache is cleared or the entry expires. The vulnerability is categorized as a failure in input validation and cache control, specifically involving the mishandling of HTTP GET parameters that alter the application's response state.\nThe affected component is the core caching engine of WP Fastest Cache in versions below 1.5.1. The attack is executable over the network without requiring any form of authentication or special privileges, as the plugin processes cache requests for all unauthenticated visitors. The impact is significant: by polluting the cache, an attacker can deliver malicious or sensitive information to unsuspecting users, effectively performing a wide-scale data exposure attack without needing to interact with individual users directly. The persistent nature of the cache ensures that the malicious state remains active across the application surface until administrative intervention occurs."
}