CVE-2026-74916
Medium · 6.5CVSS
6.5
EPSS
—
Published
Sep 1, 2026
CISA due date
—
The record
The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19033 For a secondary zone with transfers restricted by TSIG, `named` may start to serve the… CWE-349
- CVE-2026-78301 A malformed zone may contain an NS or DNAME node above its origin, which `named` treats… CWE-349
- CVE-2026-15387 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before… CWE-349
- CVE-2026-50252 In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized… CWE-349
- CVE-2026-41120 Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of… CWE-349
- CVE-2026-33612 A malicious authoritative server can send a crafted zone via the ZoneToCache function… CWE-349
- CVE-2026-46342 Nuxt is an open-source web development framework for Vue.js. CWE-349
- CVE-2026-45602 No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform… CWE-349