---
id: "CVE-2026-111464"
kind: "vulnerability"
aliases: ["CVE-2026-111464"]
title: "WP Fastest Cache: caches WordPress activation responses that expose new user passwords"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multisite", "package", "wordpress", "wp-fastest-cache"]
not_affected_if: ["plugin-not-installed", "registration-disabled", "single-site-install"]
published_at: "2026-11-03T03:16:42+00:00"
first_seen_at: "2026-11-03T03:17:58+00:00"
updated_at: "2026-11-03T03:18:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111464", "first_seen_at": "2026-11-03T03:17:58+00:00"}]
---

# WP Fastest Cache: caches WordPress activation responses that expose new user passwords

WP Fastest Cache up to and including 1.5.3 stores the WordPress Multisite activation page in a publicly reachable cache file. That file can contain the username and password of the most recently activated registrant, which an unauthenticated attacker can read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or in `wp-content/plugins/wp-fastest-cache/` for a version at or below `1.5.3`.
- Confirm whether the site is a Multisite subdirectory installation with public user and site registration enabled.
- Look for cached files under the WP Fastest Cache cache directory that contain `wp-activate` responses.

## Timeline

- 2026-11-03T03:17:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111464

## From the sources

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_