Wpbase Cache
Monthly
Denial of service in the WordPress plugin WPBase Cache (versions 5.5.6 and earlier) allows an authenticated user holding the Subscriber role - the lowest authenticated WordPress role - to consume server resources without limit and degrade or take the site offline. The attack is network-reachable, low complexity, requires no user interaction, and affects only availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium), so sites that have disabled user registration or that do not run the plugin are not exposed to anonymous attackers. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure depends on whether the target site permits self-registration or an attacker already holds subscriber credentials. Reported by Patchstack, with no vendor-fixed version confirmed in the available advisory data.
Denial of service in the WordPress plugin WPBase Cache (versions 5.5.6 and earlier) allows an authenticated user holding the Subscriber role - the lowest authenticated WordPress role - to consume server resources without limit and degrade or take the site offline. The attack is network-reachable, low complexity, requires no user interaction, and affects only availability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium), so sites that have disabled user registration or that do not run the plugin are not exposed to anonymous attackers. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical exposure depends on whether the target site permits self-registration or an attacker already holds subscriber credentials. Reported by Patchstack, with no vendor-fixed version confirmed in the available advisory data.