CVE-2025-10476 Overview
The WP Fastest Cache plugin for WordPress contains a missing authorization vulnerability [CWE-862] in the wpfc_db_fix_callback() function. All versions up to and including 1.4.0 lack a capability check on this endpoint. Authenticated users with Subscriber-level access or above can invoke database fix actions that they should not have permission to trigger. The issue affects only sites running the premium version of the plugin. The vendor addressed the flaw in version 1.4.1.
Critical Impact
Subscriber-level attackers on premium WP Fastest Cache installations can initiate unauthorized database fix operations, resulting in low-integrity impact to site data.
Affected Products
- WP Fastest Cache plugin for WordPress (premium)
- All versions up to and including 1.4.0
- WordPress sites with the premium module activated
Discovery Timeline
- 2025-11-27 - CVE-2025-10476 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10476
Vulnerability Analysis
The vulnerability resides in the wpfc_db_fix_callback() AJAX handler exposed by the WP Fastest Cache premium plugin. The handler executes database maintenance actions but does not verify whether the calling user holds an appropriate WordPress capability. Any authenticated user, including low-privileged Subscriber accounts, can therefore reach the endpoint and trigger database fix operations reserved for administrators.
Because WordPress commonly permits open user registration, the Subscriber role represents a low bar for attackers. The classification under [CWE-862] Missing Authorization reflects the absence of a current_user_can() check inside the callback. Successful invocation modifies plugin-managed database state, which maps to the low integrity impact described in the advisory. Confidentiality and availability are not directly impacted.
Root Cause
The root cause is a missing capability check inside the wpfc_db_fix_callback() function. The AJAX action was registered for authenticated users through wp_ajax_ hooks without gating execution on an administrative capability such as manage_options. Nonce verification, when present, only proves request intent and does not enforce role-based authorization.
Attack Vector
An attacker registers or authenticates as a Subscriber on a target WordPress site that has WP Fastest Cache premium active. The attacker then issues an authenticated request to the admin-ajax.php endpoint targeting the wpfc_db_fix action. The server executes the database fix routine on behalf of the low-privileged user, altering plugin data structures without administrator consent.
No user interaction beyond the attacker's own authenticated session is required. See the Wordfence Vulnerability Report and CleanTalk CVE Research for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-10476
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing action=wpfc_db_fix originating from Subscriber-level session cookies.
- Unexpected modifications to WP Fastest Cache database tables or option rows outside administrator activity windows.
- New Subscriber account registrations shortly followed by requests to WP Fastest Cache AJAX endpoints.
Detection Strategies
- Inspect web server access logs for admin-ajax.php traffic with the wpfc_db_fix action and correlate against the requesting user role.
- Enable WordPress audit logging plugins to capture invocations of plugin-registered AJAX actions by non-administrator users.
- Compare the installed plugin version against 1.4.0 and flag any host still exposing the vulnerable handler.
Monitoring Recommendations
- Alert on any non-administrator account triggering plugin management AJAX actions.
- Track spikes in new low-privilege user registrations followed by authenticated AJAX activity.
- Baseline expected database write patterns for WP Fastest Cache and alert on deviations.
How to Mitigate CVE-2025-10476
Immediate Actions Required
- Upgrade WP Fastest Cache premium to version 1.4.1 or later on all WordPress sites.
- Audit existing Subscriber and low-privilege accounts for suspicious registrations and revoke unknown users.
- Review WP Fastest Cache database state and restore from backup if unauthorized modifications are detected.
Patch Information
The vendor released a fix in WP Fastest Cache 1.4.1, which adds a capability check to wpfc_db_fix_callback(). See the WordPress Plugin Change Log for the exact code changes between 1.4.0 and 1.4.1.
Workarounds
- Disable open user registration in WordPress General Settings until the plugin is updated.
- Temporarily deactivate WP Fastest Cache premium on sites that cannot be patched immediately.
- Restrict access to /wp-admin/admin-ajax.php for the wpfc_db_fix action at the web application firewall layer.
# Update WP Fastest Cache via WP-CLI
wp plugin update wp-fastest-cache --version=1.4.1
wp plugin list --name=wp-fastest-cache --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
