Technical impact
WP Fastest Cache contains a missing capability check in the wpfc_db_fix_callback() function that permits authenticated users with Subscriber-level or higher access to trigger database cleanup actions. This flaw allows attackers to perform unauthorized modifications or deletions of site data, potentially affecting content integrity and availability. The weakness aligns with CWE-862, Missing Authorization.
Affected Systems
WordPress sites that have the WP Fastest Cache plugin installed at version 1.4.0 or earlier and have the premium feature activated are affected. Any site running these versions of the plugin is vulnerable as long as it permits subscriber or higher roles to access the site.
Risk and Exploitability
The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attacker must be authenticated with at least Subscriber privileges; the exploit requires no additional external access beyond legitimate site credentials. Once accessed, the attacker can initiate cleanup operations that alter or delete database entries, leading to data integrity risks.
