CVE-2026-107763

CVSS 4.3 (medium) · published 2026-10-17

The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.

Weakness: CWE-862

Source: NVD CVE-2026-107763

References

• https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Admin.php#L304
• https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Admin.php#L44
• https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Core/Platform/Utility.php#L372
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3737013%40fastcache-by-host-it&new=3737013%40fastcache-by-host-it
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0b4db0-2ccd-47e8-8f40-82e97726f815?source=cve

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.