The WP Fastest Cache plugin, when operating before version 1.5.1, does not include tracking‑related query parameters in its page‑cache key. As a result, the plugin caches a page request containing these parameters and serves the cached entry to future visitors who request the same clean URL without the tracking data. This allows an unauthenticated attacker to inject content that will be rendered for all subsequent users, effectively achieving a cache‑poisoning attack with a moderate‑to‑high impact on confidentiality and integrity of the cached content. The vulnerability stems from improper input handling and insufficient key differentiation, which can be classified as an authority bypass allowing unauthorized content manipulation.

WordPress sites that have the WP Fastest Cache plugin installed at any version prior to 1.5.1 are affected. The plugin, managed via the WordPress admin interface, will cache pages that include query arguments such as ._ga, ._gat, ._gid, etc., even though those arguments are not used to generate the cache key. Any site operator relying on this caching behavior without the later protection introduced in 1.5.1 is susceptible.

The CVSS score of 6.5 places the vulnerability in the medium severity range, and the EPSS score of < 1 % indicates a low exploitation probability. The issue is not listed in the CISA KEV catalog and no specific exploitation traces are reported, but the flaw can be leveraged remotely by simply adding tracking parameters to a URL. Because the attack requires no authentication or special access, the risk to sites with widely exposed URLs is significant, especially for pages that are heavily cached and serve dynamic user data.