WP Fastest Cache <= 1.5.3 — Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WP Fastest Cache – WordPress Cache Plugin.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 1.5.4, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch WP Fastest Cache – WordPress Cache Plugin to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to R3D.

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Nov 2, 2026

   CVE published

   Severity medium, CVSS 5.9

2. Nov 13, 2026

   Record last updated