WP Fastest Cache derives the on-disk cache file path from the incoming request URL. Before 1.4.5 that path was not trimmed of surrounding whitespace, and a path of exactly “/” was accepted, so a crafted request could steer the plugin to read or write a cache entry at an unintended location — alongside the existing guards that reject “..” and “//” sequences. Version 1.4.5 trims the path and rejects a bare “/” before it is used.
This vulnerability affects the following application versions:
- WP Fastest Cache 1.1.5
- WP Fastest Cache 1.1.6
- WP Fastest Cache 1.1.7
- WP Fastest Cache 1.1.8
- WP Fastest Cache 1.1.9
- WP Fastest Cache 1.2.0
- WP Fastest Cache 1.2.1
- WP Fastest Cache 1.2.2
- WP Fastest Cache 1.2.3
- WP Fastest Cache 1.2.4
- WP Fastest Cache 1.2.5
- WP Fastest Cache 1.2.6
- WP Fastest Cache 1.2.7
- WP Fastest Cache 1.2.8
- WP Fastest Cache 1.2.9
- WP Fastest Cache 1.3.0
- WP Fastest Cache 1.3.1
- WP Fastest Cache 1.3.2
- WP Fastest Cache 1.3.3
- WP Fastest Cache 1.3.4
- WP Fastest Cache 1.3.5
- WP Fastest Cache 1.3.6
- WP Fastest Cache 1.3.7
- WP Fastest Cache 1.3.8
- WP Fastest Cache 1.3.9
- WP Fastest Cache 1.4.0
- WP Fastest Cache 1.4.1
- WP Fastest Cache 1.4.2
- WP Fastest Cache 1.4.3
- WP Fastest Cache 1.4.4