CVE-2026-74916: CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data in WP Fastest Cache

CVE-2026-74916 affects the WP Fastest Cache WordPress plugin before version 1.5.1. The plugin fails to include tracking-related query parameters in its page-cache key while still caching pages requested with these parameters. As a result, an unauthenticated attacker can have a page rendered under their own request context stored in the cache entry for the clean URL, causing that cached content to be served to all subsequent visitors. This is classified under CWE-349, indicating acceptance of extraneous untrusted data with trusted data. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker can cause pages to be cached with their own request context, potentially leading to leakage or manipulation of content served to other users. This can result in partial confidentiality and integrity impacts, such as unauthorized data exposure or content alteration for visitors receiving the cached page.

No official patch or remediation level is currently documented. Users should upgrade to WP Fastest Cache version 1.5.1 or later, where this issue is fixed. Until then, consider disabling caching for URLs with tracking-related query parameters or applying custom cache key handling to include these parameters. Monitor the vendor advisory for official patches or updates.