Live › vulnerability › CVE-2026-111464
WP Fastest Cache up to and including 1.5.3 stores the WordPress Multisite activation page in a publicly reachable cache file. That file can contain the username and password of the most recently activated registrant, which an unauthenticated attacker can read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 03:17 UTC. All times on this page are UTC.
Sites running WP Fastest Cache 1.5.3 or earlier on WordPress Multisite subdirectory installations where public user and site registration is enabled. The credentials are exposed only after a real registrant follows an activation link, so single-site installs and sites with registration closed are not exposed by this flaw. The sources do not name a fixed version.
No product ranges from the sources yet.
wp-content/plugins/wp-fastest-cache/ for a version at or below 1.5.3.wp-activate responses.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.
This page as .md · .json · in your agent: get_signal("CVE-2026-111464")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.