WP REST Cache CVE-2026-116862

Exploitable by a remote, unauthenticated attacker (PR:N, UI:N) against WordPress sites running the WP REST Cache plugin (vendor acato) at version 2026.3.1 or earlier, via a missing authorization check (CWE-862) on plugin-exposed REST functionality. The specific endpoint, feature, or configuration that triggers the flaw is not described in the available sources, so no non-default setting is confirmed as required. The practical limiting factors are deployment scope - the target must have this specific plugin installed and at an affected version - and impact scope, which is confidentiality-only (C:H, I:N, A:N): the flaw exposes data but does not, on the available evidence, allow modification or denial of service.

Signals are mixed and point to a moderate, not emergency, priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact but no integrity or availability impact - consistent with CWE-862 (Missing Authorization) exposing data rather than enabling code execution or takeover. The vuln.today decision label is 'this_week' (not 'act_now' or 'emergency'), indicating it should be remediated promptly but is not treated as under active mass-exploitation. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. KEV status is absent, so there is no confirmed active exploitation. The only reference is a Patchstack advisory entry, which is a vulnerability report - not verified working exploit code - so there is no public exploit identified at time of analysis. Net: a genuine unauthenticated information-disclosure issue worth patching this week, but current signals suggest it is not yet widely weaponized; the confidentiality-only impact and the plugin's limited footprint keep real-world risk below that of a critical RCE.

A remote, unauthenticated attacker sends a crafted request to a WP REST Cache endpoint on a WordPress site running version 2026.3.1 or earlier, where a missing authorization check allows access to cached data or functionality that should be restricted. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing is required. No working public exploit code was identified; only a Patchstack advisory reference exists.