CVE-2026-23694

Aruba HiSpeed Cache < 3.0.5 CSRF in Multiple Administrative AJAX Actions

Published Feb 23, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery (CSRF) vulnerability affecting multiple administrative AJAX actions. The handlers for ahsc_reset_options, ahsc_debug_status, and ahsc_enable_purge perform authentication and capability checks but do not verify a WordPress nonce for state-changing requests. An attacker can induce a logged-in administrator to visit a malicious webpage that submits forged requests to admin-ajax.php, resulting in unauthorized resetting of plugin settings, toggling of the WordPress WP_DEBUG configuration, or modification of cache purging behavior without the administrator’s intent.

Analysis

Technical impact

The Aruba HiSpeed Cache WordPress plugin versions prior to 3.0.5 contain a cross‑site request forgery vulnerability that allows an attacker to perform unauthorized administrative actions. The vulnerability lies in multiple AJAX handlers that authenticate users but fail to verify a WordPress nonce, letting an attacker reset plugin settings, toggle the WP_DEBUG configuration, or change cache purging behavior without the administrator’s consent.

Affected Systems

The affected product is the Aruba HiSpeed Cache plugin for WordPress, distributed by Aruba.it. All installations using the plugin version earlier than 3.0.5 are vulnerable.

Risk and Exploitability

The CVSS score is 5.1, indicating moderate severity, and the EPSS score is below 1 %, meaning exploitation probability is low. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve a malicious webpage that forces a logged‑in administrator to load a crafted form that submits forged AJAX requests to admin-ajax.php, leveraging the missing nonce check.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Aruba.it

Aruba HiSpeed Cache

unaffected

Version	Status	Constraints
`0`	affected	< 3.0.5

No data.

Vendor Product Versions

Arubadev

Aruba Hispeed Cache

Version	Status	Scheme	Platform
`[0,3.0.5)`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Aruba HiSpeed Cache plugin to version 3.0.5 or later.
Restrict administrator access to a single IP address or trusted network ranges.
Install and configure a WordPress security plugin that enforces nonce checks on all admin AJAX calls.

Generated by OpenCVE AI on April 17, 2026 at 16:15 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.254% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://hosting.aruba.it/en/wordpress.aspx
https://wordpress.org/plugins/aruba-hispeed-cache/

History

Mar 5, 2026 2:15 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Aruba Aruba aruba Hispeed Cache
CPEs		cpe:2.3:a:aruba:aruba_hispeed_cache::::::wordpress::*
Vendors & Products		Aruba Aruba aruba Hispeed Cache

Feb 25, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Feb 24, 2026 10:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Arubadev Arubadev aruba Hispeed Cache Wordpress Wordpress wordpress
Vendors & Products		Arubadev Arubadev aruba Hispeed Cache Wordpress Wordpress wordpress

Feb 23, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery (CSRF) vulnerability affecting multiple administrative AJAX actions. The handlers for ahsc_reset_options, ahsc_debug_status, and ahsc_enable_purge perform authentication and capability checks but do not verify a WordPress nonce for state-changing requests. An attacker can induce a logged-in administrator to visit a malicious webpage that submits forged requests to admin-ajax.php, resulting in unauthorized resetting of plugin settings, toggling of the WordPress WP_DEBUG configuration, or modification of cache purging behavior without the administrator’s intent.
Title		Aruba HiSpeed Cache < 3.0.5 CSRF in Multiple Administrative AJAX Actions
Weaknesses		CWE-352
References		https://hosting.aruba.it/en/wordpress.aspx https://wordpress.org/plugins/aruba-hispeed-cache/
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`