CVE-2026-111464 Details
Description
The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.
A vulnerability allowing sensitive information exposure has been identified in the WP Fastest Cache plugin for WordPress, affecting all versions through 1.5.3. The issue arises because the plugin caches the response from WordPress's wp-activate.php without respecting its no-store or no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state. This oversight leads to the activation response, which contains credentials, being written to a publicly accessible cache file. As a result, unauthenticated attackers can access the plaintext username and a twelve-character password of the most recently activated Multisite registrant. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only available after a genuine registrant activates their account.
Users are advised to update the WP Fastest Cache plugin to version 1.5.4 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-524 | Use of Cache Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WP Fastest Cache | <= 1.5.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |