The WP Fastest Cache plugin caches the response of WordPress’s core wp-activate.php page without respecting its no-store/no-cache headers, the wp-activate cookie, or the WP_INSTALLING state, and writes the credential‑bearing activation response to a publicly accessible cache file. This allows an unauthenticated attacker to read the plaintext username and twelve‑character password of the most recently activated Multisite registrant from that cached response. The vulnerability is a classic example of sensitive information exposure in cached content.

Any WordPress site that uses the WP Fastest Cache plugin at version 1.5.3 or earlier, configured as a multisite subdirectory installation with public user and site registration enabled, is affected. The plugin’s caching mechanism is present only in these versions, so upgrading to 1.5.4 or higher removes the flaw.

The CVSS score is 5.9, indicating moderate severity. Because the exploitation path requires an unauthenticated visitor to trigger a real user registration and await the activation link, the attack vector is high‑traffic web access; EPSS data is unavailable, and the vulnerability is not listed in CISA KEV. An attacker who obtains the credentials could potentially log into the freshly activated account or use them to compromise other sites that rely on the same network credentials. However, the risk requires the attacker to know the activation link, which limits immediate impact but still poses a significant threat to brand reputation and security posture.