Code Injection Vulnerability in Fastcache Plugin for WordPress

CVE-2026-104021

What is CVE-2026-104021?

The Fastcache by Host.it plugin for WordPress is susceptible to code injection due to improper sanitization of the cache_cookie_exclude parameter. This vulnerability allows authenticated users with administrator access to inject arbitrary directives into the site's .htaccess file. The issue arises from the plugin's reliance on the trim() function, which inadequately sanitizes inputs, failing to remove complete newline characters. Exploitation of this vulnerability can lead to serious server-level configuration changes, including executing unauthorized PHP code, posing significant security risks to the website.

References