CVE-2026-107763: Fastcache by Host.it Auth Bypass Flaw

CVE-2026-107763 Overview

CVE-2026-107763 is an authorization bypass vulnerability in the Fastcache by Host.it plugin for WordPress. The flaw affects all versions up to and including 1.7.5. The plugin fails to verify that a requesting user is authorized to invoke sensitive actions. Authenticated attackers with subscriber-level access or above can add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. The weakness maps to Missing Authorization [CWE-862].

Critical Impact
Any logged-in subscriber can tamper with the site's root .htaccess rewrite rules managed by Fastcache, affecting caching behavior and site integrity.

Affected Products

Fastcache by Host.it plugin for WordPress
All versions up to and including 1.7.5
WordPress sites with subscriber or higher registration enabled

Discovery Timeline

2026-10-17 - CVE-2026-107763 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-107763

Vulnerability Analysis

The Fastcache by Host.it plugin exposes administrative actions that manage page-cache rewrite rules written to the WordPress root .htaccess file. These actions do not include capability checks to confirm the caller has administrative privileges. Any authenticated session, including a subscriber account, can trigger the add or remove operations.

The impact centers on site availability and integrity of caching behavior. An attacker can inject the plugin's rewrite rules into .htaccess when they should not be present, or strip them out when they should be, altering how the web server serves cached content. The vulnerability does not expose sensitive data directly, but it allows an unprivileged user to modify a security-sensitive server configuration file.

Root Cause

The root cause is a missing authorization check [CWE-862] in the plugin's admin handlers. The relevant handlers in src/Admin.php and the helper logic in src/Core/Platform/Utility.php perform the .htaccess modification without verifying the current user holds a privileged capability such as manage_options. Authentication alone is treated as sufficient to perform the operation.

Attack Vector

Exploitation requires an authenticated WordPress account with at least subscriber-level access. The attacker issues the plugin's admin request from a logged-in session. The handler executes the rewrite rule modification against the site's root .htaccess. No elevated privileges, user interaction, or complex preconditions are required beyond holding a low-privilege account. For technical details, see the WordPress FastCache Admin Code and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-107763

Indicators of Compromise

Unexpected additions or removals of Fastcache-managed rewrite blocks in the site's root .htaccess file.
WordPress access logs showing low-privilege accounts issuing requests to Fastcache admin endpoints.
Modification timestamps on .htaccess that do not align with legitimate administrator activity.

Detection Strategies

Monitor file integrity on the WordPress root .htaccess and alert on any change not tied to an administrator action.
Review web server access logs for POST or admin-ajax requests targeting Fastcache handlers from non-administrator user IDs.
Audit the WordPress user base for unexpected subscriber accounts created around the modification window.

Monitoring Recommendations

Enable file integrity monitoring on wp-config.php, .htaccess, and plugin directories.
Forward WordPress and web server logs to a central analytics platform for correlation.
Track plugin version inventory across WordPress estates to identify sites running Fastcache 1.7.5 or earlier.

How to Mitigate CVE-2026-107763

Immediate Actions Required

Update the Fastcache by Host.it plugin to a version later than 1.7.5 as soon as the vendor publishes a fix.
Restrict new user registrations or set the default role to a value that cannot reach plugin handlers if subscriber accounts are not required.
Review the site's root .htaccess and restore the intended rewrite rules if tampering is observed.

Patch Information

The vendor has committed changes tracked in the WordPress FastCache Changeset. Administrators should apply the fixed release through the WordPress plugin updater once available and verify the installed version is greater than 1.7.5.

Workarounds

Temporarily deactivate the Fastcache by Host.it plugin until a patched release is installed.
Disable open user registration under Settings → General to reduce the attacker pool.
Enforce least privilege by removing unused subscriber-level accounts and applying strong authentication for all remaining users.

bash

# Configuration example: disable open registration and enforce file permissions
wp option update users_can_register 0
chmod 644 /var/www/html/.htaccess
chown root:www-data /var/www/html/.htaccess