CVE-2026-104021: CWE-94 Improper Control of Generation of Code ('Code Injection') in hostspa Fastcache by Host.it

The Fastcache by Host.it plugin for WordPress improperly controls code generation in all versions up to and including 1.7.4. The vulnerability arises because the plugin registers the cache_cookie_exclude setting without a sanitize_callback, and the buildSiteHtaccessRules() function only trims whitespace but does not remove embedded newlines. This allows an attacker with administrator privileges to inject arbitrary Apache directives into the site's .htaccess file by breaking out of the intended capture group. The injection is performed via file_put_contents(), enabling server-level configuration changes such as setting php_value auto_prepend_file to execute attacker-controlled PHP code on every request.

An authenticated attacker with administrator-level access can inject arbitrary Apache directives into the .htaccess file, leading to server-level configuration changes. This can result in remote code execution by forcing the server to execute attacker-controlled PHP code on every request, impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious changes to the .htaccess file. Avoid using vulnerable versions of the Fastcache plugin if possible.