The WP Fastest Cache Premium plugin for WordPress contains a flaw in the "get_server_time_ajax_request" AJAX action that fails to enforce proper authorization checks. As a result, authenticated users with Subscriber-level access or higher may trigger the action to cause the server to issue HTTP requests to any target URL, potentially exfiltrating sensitive data or modifying internal services. The vulnerability leverages server‑side request forgery to allow attackers to probe or manipulate internal network resources without needing elevated privileges beyond a legitimate subscription role.

All installations of WP Fastest Cache Premium version 1.7.4 or earlier are affected; the free edition is not impacted. The flaw exists in WordPress sites that have the plugin enabled and have users with Subscriber or higher roles.

The CVSS score of 3.5 indicates a low to moderate severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires an authenticated session, the likely vector involves a user who has logged in and runs a script that calls the vulnerable AJAX endpoint. While the issue does not provide remote code execution, it can lead to data disclosure or modification of internal services, which may have significant operational impact.