The Aruba HiSpeed Cache plugin for WordPress contains a flaw where the ahsc_ajax_reset_options() function does not perform nonce verification. An unauthenticated attacker can craft a request that forces a logged‑in administrator to reset all plugin settings to their default values by simply clicking on a malicious link. This manipulation affects the plugin’s configuration and can change caching behavior without the user’s knowledge.

All installations of Aruba HiSpeed Cache version 3.0.4 or earlier are vulnerable. The flaw is present in every release up to 3.0.4; versions 3.0.5 and later contain a nonce check that mitigates the issue.

The flaw has a CVSS score of 4.3, placing it in the medium severity range. No EPSS data or KEV listing is available, indicating that it has not been widely exploited publicly yet. Attackers require only social engineering to convince an administrator to visit a forged URL. The impact is limited to configuration loss and possible service disruption caused by resetting caching settings.