CVE-2026-74932
Received Received - Intake

Host Header Injection in WP Fastest Cache

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: WPScan

Description
The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-26
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-74932

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp_fastest_cache wp_f fastest_cache From 0.9.0.3 (inc) to 1.5.0 (inc)
wp_fastest_cache wp_f fastest_cache to 1.5.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WP Fastest Cache WordPress plugin before version 1.5.1. It fails to validate the Host header when generating URLs for embedded asset files in cached pages. Attackers can exploit this to poison cached pages by injecting references to a server they control, causing arbitrary JavaScript to run for every visitor who accesses the poisoned page.

Impact Analysis

If you use the vulnerable version of WP Fastest Cache, attackers could inject malicious JavaScript into cached pages viewed by your website visitors. This could lead to session hijacking, credential theft, or defacement of your website. Visitors may unknowingly execute harmful scripts while browsing your site.

Compliance Impact

This vulnerability could lead to data breaches by allowing attackers to steal user data through injected JavaScript. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information, potentially resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the WP Fastest Cache plugin to version 1.5.1 or later to address the Host header validation issue and prevent cache poisoning.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart