{"id":"CVE-2026-111464","kind":"vulnerability","aliases":["CVE-2026-111464"],"related":[],"title":"WP Fastest Cache: caches WordPress activation responses that expose new user passwords","description":"The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.","summary":"WP Fastest Cache up to and including 1.5.3 stores the WordPress Multisite activation page in a publicly reachable cache file. That file can contain the username and password of the most recently activated registrant, which an unauthenticated attacker can read.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","wordpress","wp-fastest-cache"],"not_affected_if":["plugin-not-installed","registration-disabled","single-site-install"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or in `wp-content/plugins/wp-fastest-cache/` for a version at or below `1.5.3`.\n- Confirm whether the site is a Multisite subdirectory installation with public user and site registration enabled.\n- Look for cached files under the WP Fastest Cache cache directory that contain `wp-activate` responses.","fix":null,"status":"open","published_at":"2026-11-03T03:16:42+00:00","first_seen_at":"2026-11-03T03:17:58+00:00","triaged_at":"2026-11-03T03:18:07+00:00","updated_at":"2026-11-03T03:18:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T03:18:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Fastest Cache: caches WordPress activation responses that expose new user passwords","impact":"medium","summary":"WP Fastest Cache up to and including 1.5.3 stores the WordPress Multisite activation page in a publicly reachable cache file. That file can contain the username and password of the most recently activated registrant, which an unauthenticated attacker can read.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-fastest-cache","multisite"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads a new user's plaintext username and password from cache.","analyst_note":"Confirm the fixed version and whether the vendor has released a patch; the NVD entry does not state one.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or in `wp-content/plugins/wp-fastest-cache/` for a version at or below `1.5.3`.\n- Confirm whether the site is a Multisite subdirectory installation with public user and site registration enabled.\n- Look for cached files under the WP Fastest Cache cache directory that contain `wp-activate` responses.","plain_action":"","needs_analyst":true,"not_affected_if":["single-site-install","registration-disabled","plugin-not-installed"],"who_is_affected":"Sites running WP Fastest Cache 1.5.3 or earlier on WordPress Multisite subdirectory installations where public user and site registration is enabled. The credentials are exposed only after a real registrant follows an activation link, so single-site installs and sites with registration closed are not exposed by this flaw. The sources do not name a fixed version.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000745,"input_tokens":4287,"output_tokens":632,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111464':15A,18A '-2026':14A,17A '/no-cache':102C '1.5.3':33B,86C 'access':124C 'activ':6A,38B,58B,107C,119C,148C,181C 'attack':63B,133C 'bear':118C 'cach':3A,4A,25B,28B,44B,69C,89C,125C,153C 'charact':142C 'contain':49B 'cooki':108C 'core':93C 'credenti':117C,171C 'credential-bear':116C 'cve':13A,16A 'enabl':168C 'exploit':156C 'expos':9A,174C 'exposur':78C 'fastest':2A,24B,27B,68C 'file':45B,47B,126C 'follow':179C 'genuin':177C 'header':103C 'honor':97C 'includ':32B,85C 'inform':77C 'instal':112C,161C 'link':182C 'make':128C 'multisit':19B,37B,149C,159C 'new':10A 'no-stor':99C 'packag':20B 'page':39B 'password':12A,53B,143C 'plaintext':137C 'plugin':70C,88C 'possibl':130C 'public':42B,123C,163C 'reachabl':43B 'read':65B 'recent':57B,147C 'registr':59B,150C,167C,178C 'requir':157C 'respons':7A,91C,120C,155C 'retriev':135C 'sensit':76C 'site':166C 'state':113C 'store':34B,101C 'subdirectori':160C 'twelv':141C 'twelve-charact':140C 'unauthent':62B,132C 'user':11A,164C 'usernam':51B,138C 'version':81C 'vulner':74C 'without':96C 'wordpress':5A,21B,36B,72C 'wp':1A,23B,26B,67C,106C,111C 'wp-activ':105C 'wp-activate.php':95C,154C 'wp-fastest-cach':22B 'write':114C","nicknames":[],"mitigations":[],"who_affected":"Sites running WP Fastest Cache 1.5.3 or earlier on WordPress Multisite subdirectory installations where public user and site registration is enabled. The credentials are exposed only after a real registrant follows an activation link, so single-site installs and sites with registration closed are not exposed by this flaw. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","multisite","package","wordpress","wpfastestcache"],"first_public_at":"2026-11-03T03:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111464","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111464","severity":null,"published_at":"2026-11-03T03:16:42+00:00","modified_at":"2026-11-03T03:16:43+00:00","first_seen_at":"2026-11-03T03:17:58+00:00","fetched_at":"2026-11-03T03:17:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}