CVE-2023-1375 in WP Fastest Cache Plugin
Summary
by MITRE • 06/09/2023
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized cache deletion in versions up to, and including, 1.1.2 due to a missing capability check in the deleteCacheToolbar function . This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete the site's cache.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The vulnerability identified as CVE-2023-1375 affects the WP Fastest Cache plugin for WordPress, specifically versions up to and including 1.1.2. This represents a critical authorization flaw that undermines the security model of the caching system. The issue stems from a missing capability check within the deleteCacheToolbar function, which is designed to handle cache deletion operations through the WordPress admin interface. The flaw allows attackers who have achieved subscriber-level permissions or higher to exploit this function and perform unauthorized cache deletion across the affected WordPress site.
The technical implementation of this vulnerability demonstrates a clear violation of the principle of least privilege within WordPress security architecture. The deleteCacheToolbar function lacks proper access control validation, meaning it does not verify whether the requesting user possesses the appropriate administrative capabilities required to perform cache deletion operations. This oversight creates a pathway for privilege escalation where users with minimal permissions can leverage this function to execute operations typically restricted to administrators or editors. The vulnerability specifically targets the WordPress capability system, which is fundamental to role-based access control implementation.
From an operational impact perspective, this vulnerability can severely disrupt website availability and performance. Cache deletion attacks can cause immediate performance degradation as the site must rebuild its cached content from scratch, potentially leading to increased server load and slower response times for legitimate users. The attack vector is particularly concerning because it requires only subscriber-level access, which is often easily obtained through various means such as user registration or social engineering tactics. This low barrier to entry makes the vulnerability particularly dangerous in environments where user accounts are not properly managed or where user registration is open.
The security implications extend beyond simple cache manipulation to potentially enable more sophisticated attacks. An attacker could use this vulnerability to repeatedly delete cache files, causing ongoing performance degradation and potentially leading to denial of service conditions. This vulnerability aligns with CWE-284, which describes improper access control, and could be categorized under ATT&CK technique T1499.004 for endpoint denial of service. The flaw also represents a failure in input validation and access control mechanisms that should be implemented at multiple layers of the application security model. Organizations should immediately update to patched versions of the plugin and review their user access controls to prevent unauthorized individuals from reaching subscriber-level permissions.
Mitigation strategies should include immediate plugin updates to versions that address this capability check issue, along with comprehensive review of user permissions and access controls. Security teams should implement monitoring for unusual cache deletion patterns and establish proper role-based access control policies to ensure that only authorized personnel can perform administrative functions. Regular security audits of WordPress plugins and themes should be conducted to identify similar access control vulnerabilities that could be exploited in similar ways. The vulnerability serves as a reminder of the critical importance of proper capability checks in web applications and the need for thorough security testing of all administrative functions within content management systems.