Fastcache by Host.it CVE-2026-104021

Requires an authenticated administrator-level account (PR:H) because the injection point is the plugin's fastcache_settings[cache_cookie_exclude][] option, saved through register_setting() which lacks a sanitize_callback. Exploitation also requires that the environment uses Apache with an .htaccess file the plugin can write via file_put_contents(), and that the host honors directives like php_value auto_prepend_file (i.e. AllowOverride permits them) - on nginx or on Apache configured with AllowOverride None, the injected directives would not take effect. The decisive limiting factor is the administrator privilege requirement, which confines this to post-authentication abuse or environments that specifically restrict admins from direct file/.htaccess access.

This is a genuine but access-gated code-execution flaw, best treated as a privilege-to-RCE escalation rather than a mass-exploitable perimeter bug. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2 HIGH) correctly captures the central limiting factor: PR:H means the attacker must already hold administrator-level access to the WordPress site, since the injection is reached through the plugin's settings (register_setting without a sanitize_callback). The high confidentiality/integrity/availability impacts are justified because the end result is attacker-controlled PHP executed on every request via an .htaccess auto_prepend_file directive - effectively full server-side code execution. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this argues against emergency prioritization. The practical caveat for defenders is that a WordPress administrator already has substantial power (plugin/theme file editing, PHP execution) in many default configurations, so the real added risk is mainly in hardened or multi-admin/managed-hosting environments where admins are intentionally denied direct file/.htaccess write access - there this flaw meaningfully breaks that boundary. No signals conflict; the main gap is the absence of exploitation-probability data (EPSS/KEV/POC all unstated).

An attacker who has obtained WordPress administrator access (via compromised credentials, a second vulnerability, or a malicious/co-admin account) opens the Fastcache settings and submits a cache_cookie_exclude value containing an embedded newline followed by an Apache directive such as php_value auto_prepend_file. Because only trim() is applied, the newline survives and the injected directive is written into .htaccess by file_put_contents(), causing attacker-controlled PHP to execute on every subsequent request. No public exploit code was identified at time of analysis.