{"id":"CVE-2026-116862","kind":"vulnerability","aliases":["CVE-2026-116862"],"related":[],"title":"WP REST Cache: broken access control lets anonymous visitors bypass checks","description":"Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.","summary":"WP REST Cache <= 2026.3.1 can cache responses generated for authenticated users (Application Passwords or Basic auth) and serve them to unauthenticated visitors. The 2026.4.0 changelog describes this, and it likely matches the CVE, but the CVE id is not cited there.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp-rest-cache","fixed":["2026.4.0"],"affected":"<= 2026.3.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","rest-api","wordpress","wp-rest-cache"],"not_affected_if":["plugin-not-installed","version-2026.4.0-or-later"],"how_to_check":"In wp-admin > Plugins, check the WP REST Cache version: 2026.3.1 or earlier is affected. Or run: wp plugin get wp-rest-cache --field=version. The site is most at risk if REST clients authenticate with Application Passwords or Basic auth.","fix":"Update WP REST Cache to 2026.4.0 or later (Settings: Plugins > Update). The 2026.4.0 changelog's security entry appears to address this flaw, but it does not cite the CVE id. All caches are flushed on update.","status":"open","published_at":"2026-10-30T19:18:15+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","triaged_at":"2026-10-30T19:25:58+00:00","updated_at":"2026-10-30T19:30:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:25:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP REST Cache: broken access control lets anonymous visitors bypass checks","impact":"medium","summary":"WP REST Cache, a WordPress plugin, has a broken access control flaw in versions up to 2026.3.1. The sources do not say what data or actions an unauthenticated visitor can reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-rest-cache"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated visitors reach restricted WordPress data or actions","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116862 and the plugin's changelog for the fixed version and the exact access control impact.","how_to_check":"- Check the installed WP REST Cache plugin version in the WordPress admin under Plugins; the sources do not name a specific file or setting.\n- unknown for other checks.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running WP REST Cache at version 2026.3.1 or earlier. The sources do not say which configurations are exposed or which data is reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":4056,"output_tokens":489,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116862 and the plugin's changelog for the fixed version and the exact access control impact.","search":"'-116862':14A,17A '-2026':13A,16A '2026.3.1':34B,79C '2026.4.0':54B 'access':5A,73C 'anonym':8A 'api':25B 'applic':42B 'auth':46B 'authent':40B 'basic':45B 'broken':4A,72C 'bypass':10A 'cach':3A,30B,33B,36B,78C 'cache':21A 'changelog':55B 'check':11A 'cite':70B 'control':6A,74C 'cve':12A,15A,63B,66B 'describ':56B 'generat':38B 'id':67B 'let':7A 'like':60B 'match':61B 'packag':22B 'password':43B 'respons':37B 'rest':2A,20A,24B,29B,32B,77C 'rest-api':23B 'serv':48B 'unauthent':51B,71C 'user':41B 'version':80C 'visitor':9A,52B 'wordpress':26B 'wp':1A,19A,28B,31B,76C 'wp-rest-cach':27B 'wp-rest-cache':18A","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WP REST Cache plugin (Acato) at 2026.3.1 or earlier. The exposure is highest where REST API clients authenticate with Application Passwords or Basic auth, since those authenticated responses could be cached and shown to anonymous visitors. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116862","severity":null,"published_at":"2026-10-30T19:18:15+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:28+00:00","fetched_at":"2026-10-30T19:25:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116862:1197","url":null,"severity":null,"published_at":"2026-10-30T19:30:02+00:00","modified_at":"2026-10-30T19:30:02+00:00","first_seen_at":"2026-10-30T19:30:02+00:00","fetched_at":"2026-10-30T19:30:02+00:00","note":"NVD page unreadable; no vendor page names the CVE. Changelog 2026.4.0 (Oct 27 2026) is the only security entry after 2026.3.1 and matches an unauthenticated confidentiality-only impact (CVSS C:H/I:N/A:N), so the fix is probably 2026.4.0 but the link to this CVE is inferred, nothing verified. No PoC or exploitation found."}],"documents":[{"id":25511,"url":"https://wordpress.org/plugins/wp-rest-cache/","title":"WP REST Cache changelog (wordpress.org, 2026.4.0 security entry)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":25512,"url":"https://hol.org/guard/security/cves/CVE-2026-116862-wordpress-wp-rest-cache-plugin-202631-broken","title":"HOL Guard record CVE-2026-116862","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}