Cross-Site Request Forgery Vulnerability in Aruba HiSpeed Cache by Aruba

CVE-2026-23694

What is CVE-2026-23694?

The Aruba HiSpeed Cache plugin for WordPress suffers from a cross-site request forgery (CSRF) vulnerability in versions prior to 3.0.5. This flaw affects several administrative AJAX actions that, while performing authentication and capability checks, fail to validate a WordPress nonce for state-changing requests. An attacker could trick a logged-in administrator into visiting a malicious webpage that sends forged requests to admin-ajax.php. This exploitation can lead to unauthorized changes, such as resetting plugin settings, altering the WP_DEBUG configuration, or adjusting cache purging behavior without the administrator's consent.

References