Sensitive Information Exposure in WP Fastest Cache Plugin by WordPress

CVE-2026-111464

What is CVE-2026-111464?

The WP Fastest Cache plugin for WordPress contains a vulnerability where sensitive information can be exposed. The plugin unwisely caches the response from wp-activate.php without adhering to its no-store/no-cache headers or the wp-activate-* cookie, leading to the storage of activation responses in publicly accessible cache files. This flaw allows unauthenticated attackers to access the plaintext username and password of the most recently activated Multisite registrant after they follow their activation link. It requires a Multisite subdirectory setup with public user and site registration enabled, showcasing a significant security oversight that could lead to unauthorized access.

References