Fastcache By Host It
Monthly
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Authorization bypass in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.5) allows any authenticated user with subscriber-level access to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. The root cause is a missing capability check (CWE-862) on the plugin's rewrite-rule management action, reachable remotely with low attack complexity and no user interaction. Impact is limited to the plugin's own cache rules rather than arbitrary file content, and no public exploit code or confirmed active exploitation was identified at time of analysis; overall priority is low (CVSS 4.3).
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Authorization bypass in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.5) allows any authenticated user with subscriber-level access to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. The root cause is a missing capability check (CWE-862) on the plugin's rewrite-rule management action, reachable remotely with low attack complexity and no user interaction. Impact is limited to the plugin's own cache rules rather than arbitrary file content, and no public exploit code or confirmed active exploitation was identified at time of analysis; overall priority is low (CVSS 4.3).