---
id: CVE-2026-111464
title: >-
  WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via
  Cached wp-activate.php Response
summary: >-
  The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive
  Information Exposure in all versions up to, and including, 1.5.3. The plugin
  caches the response of Core’s wp-activate.php without honoring its
  no-store/no-cache header…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-524
vendor: emrevona
product: WP Fastest Cache – WordPress Cache Plugin
affected:
  - wp_fastest_cache_wordpress_cache_plugin <= 1.5.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T13:23:01.915368Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:23:51.631Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111464'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/83539a88-b90e-49f0-a599-b3f83b2d97b9?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L1027
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L452
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L567
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L1400
  - url: >-
      https://plugins.trac.wordpress.org/browser/wp-fastest-cache/tags/1.5.2/inc/cache.php#L83
  - url: 'https://plugins.trac.wordpress.org/changeset/3749897/wp-fastest-cache'
tags:
  - cve.org
epss: 0.00417
epssPercentile: 0.36208
ingestedAt: '2026-11-05T19:30:42.947Z'
---

## Overview

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.

## Affected

- `wp_fastest_cache_wordpress_cache_plugin <= 1.5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.