WP Fastest Cache EUVD-2026-115657

Exploitation is strictly gated: the site must be a WordPress Multisite SUBDIRECTORY installation with public user AND site registration enabled, and WP Fastest Cache (<=1.5.3) must be caching the wp-activate.php response despite its no-store/no-cache headers, the wp-activate-* cookie, and the WP_INSTALLING state. Credentials are exposed ONLY after a genuine registrant actually follows their activation link, and only the MOST RECENTLY activated registrant's username and twelve-character password are present in the cached file, making the exposure window transient and dependent on real registration activity the attacker does not control. These conditions - non-default Multisite mode, open registration, and reliance on a legitimate user's activation event - are the primary limiting factors and explain the AC:H rating.

Signals point to a genuine but conditional, moderate-severity issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9 MEDIUM) shows network reach with no authentication, but the high attack complexity reflects real preconditions outside the attacker's control. The vuln.today decision label is 'this_month' (not act_now/emergency), it is not on CISA KEV (no confirmed active exploitation), and no EPSS score was supplied in the input, so widespread-exploitation probability cannot be quantified here. There is no public exploit identified at time of analysis - the references contain only the Wordfence advisory, WordPress trac source lines, and the fixing changeset (3749897), none of which is a PoC. The confidentiality impact is real and serious (plaintext credential disclosure, C:H), but exploitation hinges on a narrow configuration (Multisite subdirectory with open registration) and on a legitimate registrant actually completing activation, with only the most-recently-activated account exposed in a transient cache window. Net: treat as a real but scoped priority - patch within the vendor/priority 'this_month' window; it is not a mass, default-configuration internet threat.

An attacker monitors a WordPress Multisite subdirectory installation that runs WP Fastest Cache and allows public user/site registration. After a genuine new registrant follows their activation link, the plugin caches the wp-activate.php response to a publicly readable file; the attacker then requests that cached file and reads the registrant's plaintext username and twelve-character password. No public exploit code was identified at time of analysis, and the attack only works against the most recently activated account.