The Aruba HiSpeed Cache WordPress plugin versions prior to 3.0.5 contain a cross‑site request forgery vulnerability that allows an attacker to perform unauthorized administrative actions. The vulnerability lies in multiple AJAX handlers that authenticate users but fail to verify a WordPress nonce, letting an attacker reset plugin settings, toggle the WP_DEBUG configuration, or change cache purging behavior without the administrator’s consent.

The affected product is the Aruba HiSpeed Cache plugin for WordPress, distributed by Aruba.it. All installations using the plugin version earlier than 3.0.5 are vulnerable.

The CVSS score is 5.1, indicating moderate severity, and the EPSS score is below 1 %, meaning exploitation probability is low. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve a malicious webpage that forces a logged‑in administrator to load a crafted form that submits forged AJAX requests to admin-ajax.php, leveraging the missing nonce check.