Improper URL Validation in Cache Enabler Plugin for WordPress
CVE-2026-19253
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 October 2026
Badges
What is CVE-2026-19253?
The Cache Enabler WordPress plugin, prior to version 1.8.17, contains a vulnerability that allows unauthenticated users to exploit the URL handling in its cache purge process. By failing to validate a user-supplied URL, the plugin can generate a filesystem path that extends beyond its intended cache directory, enabling unauthorized file and directory deletions. This oversight can lead to significant security risks on WordPress sites utilizing this plugin, particularly under scenarios where the URL derived from user input is incorrectly handled through the public cache-clearing hook.
Affected Version(s)
Cache Enabler 0 < 1.8.17
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.