CVE-2026-74932: WP Fastest Cache XSS Vulnerability

CVE-2026-74932 Overview

The WP Fastest Cache WordPress plugin contains a web cache poisoning vulnerability in versions before 1.5.1. The plugin uses the HTTP Host header to construct URLs for asset files embedded in cached pages, but does not validate the header or include it in the cache key. Unauthenticated attackers can poison the cache with references to attacker-controlled servers, causing arbitrary JavaScript to execute for every subsequent visitor. The flaw is categorized as Cross-Site Scripting [CWE-79].

Critical Impact

A single crafted request can poison a cached page and serve attacker-controlled JavaScript to every visitor of the affected WordPress site.

Affected Products

• WP Fastest Cache WordPress plugin versions before 1.5.1
• WordPress sites using the vulnerable plugin as their caching layer
• Any WordPress deployment where the plugin caches pages without normalized Host headers

Discovery Timeline

• 2026-08-25 - CVE-2026-74932 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-74932

Vulnerability Analysis

The vulnerability stems from unsafe use of the HTTP Host header during page caching. WP Fastest Cache reads the Host header supplied by the client and uses it to build absolute URLs for CSS, JavaScript, and other embedded assets. The plugin then stores the resulting HTML in its cache. Because the Host header is not part of the cache key, the poisoned response is served to all subsequent visitors regardless of the header they send.

An attacker sends a single request with a malicious Host header pointing to a server they control. The plugin generates and caches a page containing <script> tags that load resources from the attacker's origin. Every visitor who requests the cached page then executes attacker-supplied JavaScript in the context of the WordPress site, enabling session theft, credential harvesting, defacement, and drive-by malware delivery.

Root Cause

The root cause is missing input validation on the Host header combined with an incomplete cache key. The plugin trusts a client-controlled header for URL construction and omits that same header from the cache lookup. This mismatch is the canonical precondition for web cache poisoning attacks.

Attack Vector

Exploitation requires network access to the target site and user interaction, since a subsequent visitor must load the poisoned cached page. No authentication is required. The attacker crafts an HTTP request with a spoofed Host header targeting an uncached URL, causing the plugin to cache the malicious response. Technical details are documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-74932

Indicators of Compromise

• Cached HTML files under the WP Fastest Cache directory containing <script> or <link> tags referencing external domains not owned by the site operator
• HTTP requests in web server logs with Host header values that differ from the site's canonical hostname
• Unexpected outbound requests from visitor browsers to unfamiliar third-party JavaScript origins

Detection Strategies

• Audit the plugin's cache directory for HTML files whose asset URLs reference hostnames other than the site's canonical domain
• Compare the Host header in access logs against an allowlist of valid hostnames configured for the WordPress site
• Use content security policy reporting to identify script loads from unexpected origins served from cached pages

Monitoring Recommendations

• Log every incoming Host header at the reverse proxy or WAF layer and alert on values outside the approved allowlist
• Monitor the cache directory for newly written files whose contents include external script references
• Track client-side script errors and CSP violations that spike after cache regeneration events

How to Mitigate CVE-2026-74932

Immediate Actions Required

• Upgrade the WP Fastest Cache plugin to version 1.5.1 or later on all WordPress instances
• Purge the existing cache after upgrading to remove any previously poisoned entries
• Review recently cached pages for references to unknown external domains before restoring service

Patch Information

The vendor addressed the issue in WP Fastest Cache version 1.5.1. The fix validates the Host header against the site's configured hostname before using it in generated URLs. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Configure the web server or reverse proxy to reject requests whose Host header does not match the site's canonical domain
• Enforce a strict Content Security Policy that restricts script sources to trusted origins
• Temporarily disable WP Fastest Cache if immediate patching is not feasible

# Nginx example: reject requests with unexpected Host headers
server {
    listen 80 default_server;
    server_name _;
    return 444;
}

server {
    listen 80;
    server_name example.com www.example.com;
    # normal site configuration
}