CVE-2026-74932

Deferred Deferred - Pending Action

Host Header Injection in WP Fastest Cache

Publication date: 2026-08-25

Last updated on: 2026-08-26

Assigner: WPScan

Description

The WP Fastest Cache WordPress plugin before 1.5.1 does not validate the Host header before using it to build the URLs of the asset files it embeds in the pages it caches, and does not include that header in the cache key, allowing unauthenticated attackers to poison cached pages with references to a server they control and have arbitrary JavaScript run for every subsequent visitor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-26

Generated

2026-09-15

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-14

NVD

CVE-2026-74932

Affected Vendors & Products

Vendor	Product	Version / Range
wp_fastest_cache	wp_f	fastest_cache From 0.9.0.3 (inc) to 1.5.0 (inc)
wp_fastest_cache	wp_f	fastest_cache to 1.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects the WP Fastest Cache WordPress plugin before version 1.5.1. It fails to validate the Host header when generating URLs for embedded asset files in cached pages. Attackers can exploit this to poison cached pages by injecting references to a server they control, causing arbitrary JavaScript to run for every visitor who accesses the poisoned page.

Detection Guidance

To detect this vulnerability, check if your WP Fastest Cache plugin version is between 0.9.0.3 and 1.5.0. Inspect cached pages for unexpected JavaScript references or unusual Host header usage. Monitor network traffic for requests with manipulated Host headers pointing to external domains.

Impact Analysis

If you use the vulnerable version of WP Fastest Cache, attackers could inject malicious JavaScript into cached pages viewed by your website visitors. This could lead to session hijacking, credential theft, or defacement of your website. Visitors may unknowingly execute harmful scripts while browsing your site.

Compliance Impact

This vulnerability could lead to data breaches by allowing attackers to steal user data through injected JavaScript. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information, potentially resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update the WP Fastest Cache plugin to version 1.5.1 or later to address the Host header validation issue and prevent cache poisoning.

Hi! I’m here to help you understand CVE-2026-74932. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70