Cache Enabler CVE-2026-19253

Exploitation requires that the target site run Cache Enabler before 1.8.17 AND that some installed code path (another plugin, theme, or integration) passes a request-derived URL into Cache Enabler's PUBLIC cache-clearing hook - this is the concrete precondition the description describes and is why the vendor rates AC:H rather than AC:L. The vulnerable purge routine does not validate the URL before constructing a filesystem path and does not confine the resulting deletion to the cache directory. No authentication (PR:N) and no user interaction (UI:N) are needed once that precondition is met, so it is remotely reachable; the limiting factor is the non-default requirement that an attacker-influenceable URL actually reaches the public hook, which not all deployments satisfy.

CVSS 3.1 base score 8.7 (vendor-provided vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H) rates this HIGH, driven by network reach, no authentication (PR:N), no user interaction, a scope change (S:C), and high integrity/availability impact (I:H/A:H) from arbitrary file and directory deletion. The elevated AC:H is the single most important risk-dampening signal: exploitation is NOT trivially universal because it depends on a specific precondition - another code path (plugin/theme/integration) must pass a request-derived URL into Cache Enabler's public cache-clearing hook, so the attacker does not fully control all conditions. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC referenced in the provided data; the only source is a WPScan advisory. This is therefore a real, high-impact destructive vulnerability (unauthenticated file deletion can wreck a site and cause denial of service) but current real-world exploitation evidence is absent and the AC:H condition limits automatable mass exploitation. Note a metadata conflict: the input Tag 'Information Disclosure' contradicts the actual impact, which is file/directory deletion with C:N and I:H/A:H (no confidentiality loss) - the tag is mislabeled and should not drive triage toward a disclosure interpretation.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site whose configuration causes a request-derived URL to be forwarded to Cache Enabler's public cache-clearing hook. Because the plugin builds a filesystem path from that URL without validation and does not confine deletion to the cache directory, the attacker triggers deletion of arbitrary files or directories (e.g. wp-config.php or core files), corrupting or disabling the site. No POC is referenced in the available data, and the CVSS AC:H reflects the non-default precondition that something must feed the attacker-influenced URL into the public hook.