Threat database

The Fastcache by Host.it WordPress plugin up to version 1.7.5 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can modify the site's root .htaccess file by adding or removing page-cache rewrite rules without proper authorization checks. This vulnerability does not impact confidentiality or availability but allows unauthorized integrity modifications to the web server configuration.

Fastcache by Host.it WordPress plugin versions up to 1.7.4 contain a code injection vulnerability via the cache_cookie_exclude parameter. Authenticated administrators can inject arbitrary Apache directives into the .htaccess file, enabling server-level configuration changes and potential remote code execution. The vulnerability arises from improper sanitization of user input before writing to .htaccess.