---
id: "CVE-2026-116862"
kind: "vulnerability"
aliases: ["CVE-2026-116862"]
title: "WP REST Cache: broken access control lets anonymous visitors bypass checks"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp-rest-cache", "fixed": ["2026.4.0"], "affected": "<= 2026.3.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "rest-api", "wordpress", "wp-rest-cache"]
not_affected_if: ["plugin-not-installed", "version-2026.4.0-or-later"]
published_at: "2026-10-30T19:18:15+00:00"
first_seen_at: "2026-10-30T19:25:28+00:00"
updated_at: "2026-10-30T19:30:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116862", "first_seen_at": "2026-10-30T19:25:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:30:02+00:00"}]
---

# WP REST Cache: broken access control lets anonymous visitors bypass checks

WP REST Cache <= 2026.3.1 can cache responses generated for authenticated users (Application Passwords or Basic auth) and serve them to unauthenticated visitors. The 2026.4.0 changelog describes this, and it likely matches the CVE, but the CVE id is not cited there.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wp-rest-cache affected <= 2026.3.1 fixed 2026.4.0

## How to check

In wp-admin > Plugins, check the WP REST Cache version: 2026.3.1 or earlier is affected. Or run: wp plugin get wp-rest-cache --field=version. The site is most at risk if REST clients authenticate with Application Passwords or Basic auth.

## Fix

Update WP REST Cache to 2026.4.0 or later (Settings: Plugins > Update). The 2026.4.0 changelog's security entry appears to address this flaw, but it does not cite the CVE id. All caches are flushed on update.

## Timeline

- 2026-10-30T19:25:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116862
- 2026-10-30T19:30:02+00:00 analyst — NVD page unreadable; no vendor page names the CVE. Changelog 2026.4.0 (Oct 27 2026) is the only security entry after 2026.3.1 and matches an unauthenticated confidentiality-only impact (CVSS C:H/I:N/A:N), so the fix is probably 2026.4.0 but the link to this CVE is inferred, nothing verified. No PoC or exploitation found.

## Documents

- [fix] WP REST Cache changelog (wordpress.org, 2026.4.0 security entry) https://wordpress.org/plugins/wp-rest-cache/
- [mentions] HOL Guard record CVE-2026-116862 https://hol.org/guard/security/cves/CVE-2026-116862-wordpress-wp-rest-cache-plugin-202631-broken

## From the sources

Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_