Live › vulnerability › CVE-2026-107763
Go to dashboardThe Fastcache by Host.it WordPress plugin up to and including 1.7.5 does not check authorization on an action, so a logged-in subscriber can add or remove its page-cache rewrite rules in the site's root .htaccess file. The attacker can change how the web server routes requests, which can disrupt or redirect site traffic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
WordPress sites running the Fastcache by Host.it plugin at version 1.7.5 or earlier are exposed. The attacker needs a logged-in account with subscriber-level access, so sites that do not allow public signup or have no user accounts are much less exposed. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get fastcache --field=version if WP-CLI is available..htaccess file.1.7.5; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.
This page as .md · .json · in your agent: get_signal("CVE-2026-107763")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.