Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
medium
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
- CVSS:
- 4.3
(Wordfence)
- Affected:
- up to 1.7.5
- Fixed in:
- 1.7.6
- Disclosed:
- Oct 16, 2026
CVE-2026-107763 on NVD →
Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
high
The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the `fastcache_settings[cache_cookie_exclude][]` parameter. This is due to the plugin registering the `cache_cookie_exclude` setting via `register_setting()` without a `sanitize_callback`, while...
- CVSS:
- 7.2
(Wordfence)
- Affected:
- up to 1.7.4
- Fixed in:
- 1.7.5
- Disclosed:
- Oct 9, 2026
CVE-2026-104021 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database