emrevona WP Fastest Cache Plugin up to 1.5.3 on WordPress Caching wp-activate.php missing encryption

Summaryinfo

A vulnerability was found in emrevona WP Fastest Cache Plugin up to 1.5.3. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the file wp-activate.php of the component Caching. Performing a manipulation results in missing encryption. This vulnerability is known as CVE-2026-111464. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in emrevona WP Fastest Cache Plugin up to 1.5.3. This affects an unknown code block of the file wp-activate.php of the component Caching. The manipulation with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. The summary by CVE is:

The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link.

It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2026-111464 since 10/16/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

By approaching the search of inurl:wp-activate.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-115657). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• emrevona

Name

• WP Fastest Cache Plugin

Version

• 1.5.0
• 1.5.1
• 1.5.2
• 1.5.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion