Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
Si tu WordPress usa WP Fastest Cache (0.8.7.7 a 1.5.0), pasa a 1.5.1 y vacía la caché. El 9 set publican cómo se ataca. Si no, pueden dejar basura en la página del cliente. https://www.wavys-technologies.com/es/blog/wp-fastest-cache-cve-2026-74916
Post summary
The post warns of a CVE affecting WP Fastest Cache and recommends upgrading to v1.5.1 and flushing the cache; it also links to a blog post that describes how the exploit works.