The AJAX handlers that add, remove and list the “clear cache on specific pages” rules in WP Fastest Cache verified only a nonce and never checked the caller’s capabilities. Any authenticated user who could obtain the nonce from an admin page could change or read the site’s cache-clearing rules. The fix requires the manage_options capability before the request is processed and rejects requests where the nonce parameter is absent.
This vulnerability affects the following application versions:
- WP Fastest Cache 1.0.7
- WP Fastest Cache 1.0.8
- WP Fastest Cache 1.0.9
- WP Fastest Cache 1.1.0
- WP Fastest Cache 1.1.1
- WP Fastest Cache 1.1.2
- WP Fastest Cache 1.1.3
- WP Fastest Cache 1.1.4
- WP Fastest Cache 1.1.5
- WP Fastest Cache 1.1.6
- WP Fastest Cache 1.1.7
- WP Fastest Cache 1.1.8
- WP Fastest Cache 1.1.9
- WP Fastest Cache 1.2.0
- WP Fastest Cache 1.2.1
- WP Fastest Cache 1.2.2
- WP Fastest Cache 1.2.3
- WP Fastest Cache 1.2.4
- WP Fastest Cache 1.2.5
- WP Fastest Cache 1.2.6
- WP Fastest Cache 1.2.7
- WP Fastest Cache 1.2.8
- WP Fastest Cache 1.2.9
- WP Fastest Cache 1.3.0
- WP Fastest Cache 1.3.1
- WP Fastest Cache 1.3.2
- WP Fastest Cache 1.3.3
- WP Fastest Cache 1.3.4
- WP Fastest Cache 1.3.5
- WP Fastest Cache 1.3.6
- WP Fastest Cache 1.3.7
- WP Fastest Cache 1.3.8
- WP Fastest Cache 1.3.9
- WP Fastest Cache 1.4.0
- WP Fastest Cache 1.4.1
- WP Fastest Cache 1.4.2
- WP Fastest Cache 1.4.3
- WP Fastest Cache 1.4.4
- WP Fastest Cache 1.4.5
- WP Fastest Cache 1.4.6
- WP Fastest Cache 1.4.7
- WP Fastest Cache 1.4.8
- WP Fastest Cache 1.4.9
- WP Fastest Cache 1.5.0
- WP Fastest Cache 1.5.1