Fastcache CVE-2026-107763

Requires an authenticated WordPress account with subscriber-level privileges or above (CVSS PR:L); on sites permitting open user registration this is trivially met, but on sites that disable self-registration the attacker must already hold valid credentials. The specific precondition is that the Fastcache by Host.it plugin (version ≤1.7.5) is installed and active, and exploitation targets its page-cache rewrite-rule management action, which lacks a capability/authorization check. No user interaction (UI:N) and no special non-default configuration are required beyond the plugin being present; impact is limited to adding or removing the plugin's own cache rewrite rules in the root .htaccess, not arbitrary file content.

This is a genuine but low-priority issue. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 Medium) reflects the reality: exploitation is network-based and low-complexity, but requires authentication at subscriber level or above (PR:L), and the only impact is a limited integrity effect (I:L) - the ability to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess. There is no confidentiality (C:N) or availability (A:N) impact per NVD, and the scope is unchanged (S:U). No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit code referenced - exploitation status is 'no public exploit identified at time of analysis'. No SSVC decision data was supplied. The practical risk is bounded by the authentication requirement (any logged-in user, which on open-registration sites includes attacker-created subscriber accounts) and by the narrow, non-destructive-by-design nature of the write (toggling cache rewrite rules rather than injecting arbitrary .htaccess directives). Note a possible underscore in the official scoring: corrupting or removing root .htaccess rewrite rules could plausibly degrade site availability or integrity of routing, yet A:N is assigned - defenders relying on 'no availability impact' should verify the real-world effect of rule removal on their deployment.

On a WordPress site that allows user registration, an attacker registers a low-privilege subscriber account, authenticates, and invokes the plugin's unprotected cache-management action to add or remove page-cache rewrite rules in the site's root .htaccess. This can disrupt the site's caching behavior or rewrite configuration despite the attacker having no administrative rights. No public exploit code is identified at time of analysis, and low attack complexity means the request is trivial to craft once the missing authorization check is understood.