Live › vulnerability › CVE-2026-116862
WP REST Cache <= 2026.3.1 can cache responses generated for authenticated users (Application Passwords or Basic auth) and serve them to unauthenticated visitors. The 2026.4.0 changelog describes this, and it likely matches the CVE, but the CVE id is not cited there.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
WordPress sites running the WP REST Cache plugin (Acato) at 2026.3.1 or earlier. The exposure is highest where REST API clients authenticate with Application Passwords or Basic auth, since those authenticated responses could be cached and shown to anonymous visitors. Sites without the plugin can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| wp-rest-cache | wordpress | <= 2026.3.1 | 2026.4.0 |
2026.3.1 or earlier is affected2026.4.0 or later (Settings: Plugins > Update)2026.4.0 changelog's security entry appears to address this flaw, but it does not cite the CVE idEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116862")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.