CVE-2026-74916: WP Fastest Cache Auth Bypass Vulnerability

CVE-2026-74916 Overview

CVE-2026-74916 is a cache poisoning vulnerability in the WP Fastest Cache WordPress plugin before version 1.5.1. The plugin excludes tracking-related query parameters from its page-cache key but still caches responses generated for URLs containing those parameters. An unauthenticated attacker can request a page with tracking parameters, cause the plugin to store the response under the clean URL's cache entry, and have that response served to every subsequent visitor. This constitutes an Improperly Trusted Reverse DNS class flaw tracked as [CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data].

Critical Impact
Attackers can poison the shared cache so any content rendered under their request context is served to all site visitors, enabling defacement, redirection, or exposure of attacker-controlled data.

Affected Products

WP Fastest Cache WordPress plugin versions prior to 1.5.1
WordPress sites running the plugin with page caching enabled
Deployments that permit unauthenticated requests with tracking query parameters

Discovery Timeline

2026-09-01 - CVE-2026-74916 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-74916

Vulnerability Analysis

The WP Fastest Cache plugin generates a cache key for each requested URL to determine which cached page to serve. To avoid duplicating cache entries for links tagged with analytics parameters, the plugin strips tracking-related query parameters such as utm_source, utm_medium, and similar identifiers from the key. The stripping logic is applied only to key generation. The plugin still processes and caches the response returned for the request that contained those parameters.

When an attacker requests a URL with tracking parameters, the resulting response reflects the attacker's request context. That response is then written into the cache slot for the clean URL. Later visitors requesting the clean URL receive the attacker-influenced response until the entry expires or is purged.

Root Cause

The root cause is inconsistent handling of untrusted input between cache key normalization and cache storage. Tracking parameters are treated as safe for key deduplication but are not stripped from the request that generates the cached content. This mismatch violates the assumption that the cache key uniquely identifies the response body.

Attack Vector

Exploitation requires only network access to the vulnerable site. The attacker sends an unauthenticated HTTP GET request to a cacheable page with one or more tracking query parameters. If the response varies based on request context, headers, or parameter reflection, the poisoned content is stored under the clean URL and served to every subsequent visitor. Refer to the WPScan Vulnerability Report for reproduction details.

Detection Methods for CVE-2026-74916

Indicators of Compromise

Unexpected content, links, or redirects appearing on cached WordPress pages served to anonymous visitors
Access log entries showing repeated unauthenticated requests to cacheable URLs containing utm_* or similar tracking parameters
Cache files on disk whose stored response bodies contain reflected tracking parameter values from prior requests

Detection Strategies

Compare rendered output of clean URLs against the origin server response to identify mismatched cached content
Review the plugin's cache directory for entries whose body content includes attacker-controllable parameter values
Correlate web server access logs with cache write timestamps to identify which request populated each cache entry

Monitoring Recommendations

Alert on high volumes of unauthenticated requests containing tracking parameters targeting the same URL path
Monitor for anomalous outbound links, script tags, or redirects in cached responses served to visitors
Track cache hit ratios and content diffs on high-traffic pages to detect unexpected cache state changes

How to Mitigate CVE-2026-74916

Immediate Actions Required

Upgrade WP Fastest Cache to version 1.5.1 or later on all affected WordPress installations
Purge the entire plugin cache after upgrading to remove any poisoned entries stored before the patch
Audit recently served pages for signs of injected content, redirects, or unauthorized modifications

Patch Information

The vendor addressed the vulnerability in WP Fastest Cache version 1.5.1. The fix aligns cache key normalization with request handling so that tracking parameters no longer cause attacker-influenced responses to be stored under the clean URL entry. See the WPScan Vulnerability Report for the full advisory.

Workarounds

Disable page caching in WP Fastest Cache until the plugin is updated to version 1.5.1
Configure an upstream web application firewall to strip tracking query parameters from inbound requests before they reach WordPress
Restrict cache writes to requests without query strings by adjusting reverse-proxy or CDN caching rules

bash

# Example WAF rule to strip tracking parameters before caching
# (nginx map + rewrite pattern)
map $args $clean_args {
    default $args;
    ~*(^|&)utm_[^=]+=[^&]*  "";
}
rewrite ^(.*)$ $1?$clean_args? break;