CVE-2026-107763 Details
Description
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.
A vulnerability exists in the Fastcache by Host.it WordPress plugin, affecting all versions up to and including 1.7.5. The issue stems from the plugin's failure to properly verify user authorization, allowing authenticated users with subscriber-level access and above to manipulate the site's root .htaccess file. Specifically, these users can add or remove the plugin's page-cache rewrite rules, potentially disrupting the site's caching mechanism and performance.
Users are advised to update the Fastcache by Host.it WordPress plugin to version 1.7.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Host.it Fastcache | <= 1.7.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |