A security update has been released for WP Fastest Cache, a popular WordPress caching plugin used on more than one million websites.

Website owners should update WP Fastest Cache to version 1.5.2 as soon as possible. Versions 1.5.0 and earlier contain two vulnerabilities that can potentially be exploited without an attacker having a WordPress account.

What Was Discovered?

The first vulnerability, identified as CVE-2026-74916, involves cache poisoning.

WP Fastest Cache could create a shared cached page from a request containing manipulated query-string parameters. That altered version could then be delivered to people visiting the normal website address.

This vulnerability affects WP Fastest Cache versions 0.8.7.7 through 1.5.0 and received a CVSS severity score of 6.1.

A second vulnerability, CVE-2026-19760, involves stored cross-site scripting, commonly called stored XSS.

Under certain configurations, an unauthenticated attacker could cause malicious JavaScript to be written into a website’s shared cache. That code could then execute when visitors or administrators opened the affected page.

This particular attack requires Polylang or Polylang Pro to be active while WP Fastest Cache’s Combine JS feature is enabled. It received a CVSS severity score of 7.2.

What Could an Attacker Do?

Depending on the website’s configuration and the vulnerability being exploited, an attacker could potentially:

• Display altered or fraudulent content
• Redirect visitors to another website
• Inject advertisements or SEO spam
• Capture information entered into an affected page
• Execute actions through a logged-in administrator’s browser
• Damage the website’s reputation or search visibility

These vulnerabilities do not automatically provide direct access to the server, database or hosting account. Receiving a vulnerability warning also does not mean that a website has already been compromised.

It does mean that affected installations should be updated promptly.

Which Versions Are Affected?

WP Fastest Cache 1.5.0 and earlier should be considered vulnerable.

Version 1.5.1 corrected the two publicly disclosed cache-poisoning and stored-XSS vulnerabilities. Version 1.5.2 includes those corrections along with additional security improvements and stronger permission checks for Varnish and page-specific cache-management functions.

As of September 14, 2026, website owners should update directly to version 1.5.2.

What Website Owners Should Do

Updating the plugin is only the first step. Because this vulnerability involves cached content, every applicable cache should also be purged.

Website owners and administrators should:

1. Create or verify a current website backup.
2. Update WP Fastest Cache to version 1.5.2.
3. Select “Delete Cache and Minified CSS/JS” from WP Fastest Cache.
4. Purge any Cloudflare, CDN, Varnish, proxy or hosting-level cache.
5. Run a complete Wordfence or comparable security scan.
6. Check the website for unfamiliar scripts, redirects, administrator accounts or modified files.

Clearing every cache layer helps ensure that content created before the update is not still being delivered to visitors.

Should You Assume Your Website Was Hacked?

No. A vulnerable plugin is not the same thing as a confirmed compromise.

If the plugin is updated, every cache is cleared, the website scans clean and there are no unexplained redirects, administrator accounts or file changes, there is generally no reason to assume a breach occurred.

If suspicious behavior is discovered, the website should be treated as a possible security incident and examined before normal operation continues.

Tarheel Media Can Help

Keeping WordPress software updated is an essential part of maintaining a secure website. A firewall such as Wordfence can help block malicious traffic, but it does not replace installing security updates.

If you are uncertain whether your website uses WP Fastest Cache, which version is installed or whether every cache layer has been cleared, contact Tarheel Media for assistance.

Additional technical information is available through the official WP Fastest Cache changelog, Wordfence’s cache-poisoning advisory and Wordfence’s stored-XSS advisory.

The post Urgent WP Fastest Cache Security Update: What Website Owners Need to Know appeared first on Tarheel Media.

1. Strong Usernames and Passwords
   The first line of defense for your WordPress website is a robust username and password combination. Avoid using common usernames like “admin” and create unique, complex passwords that include a combination of letters, numbers, and special characters. Regularly update your passwords and consider using password management tools to securely store and generate strong passwords.
2. Two-Factor Authentication
   Implementing two-factor authentication (2FA) adds an extra layer of security to your WordPress login process. It requires users to provide a second form of authentication, such as a temporary code generated by a mobile app or sent via SMS. By enabling 2FA, even if someone obtains your username and password, they would still need the additional authentication factor to gain access.
3. Keeping WordPress and Plugins Up to Date
   Regularly updating your WordPress core files and plugins is crucial for maintaining website security. Updates often include security patches and bug fixes that address vulnerabilities. Enable automatic updates whenever possible, and regularly check for plugin updates from reputable developers. Outdated software is a common entry point for hackers, so staying up to date is essential.
4. Secure Hosting Environment
   Choose a reliable and secure hosting provider for your WordPress website. Look for hosts that offer features like server-level firewalls, intrusion detection systems, and regular backups. A secure hosting environment provides an added layer of protection against potential threats and helps ensure the integrity of your website’s data.
5. Limit Login Attempts
   Brute-force attacks, where hackers attempt to gain access by trying multiple username and password combinations, are a common threat to WordPress websites. Limiting login attempts can mitigate this risk. Consider using security plugins like Wordfence, which provides functionality to restrict the number of login attempts and lockout suspicious IP addresses.
6. Wordfence Security Plugin
   Wordfence is a powerful security plugin designed specifically for WordPress. It offers a range of features to protect your website, including firewall protection, malware scanning, login security, and blocking suspicious IP addresses. Wordfence also provides real-time threat intelligence, monitoring your website for potential security risks and notifying you of any suspicious activity.
7. Regular Backups
   Creating regular backups of your WordPress website is essential in case of a security breach or other unforeseen events. Backups allow you to restore your website to a previous state and minimize potential damage. Use reliable backup solutions, either through your hosting provider or WordPress backup plugins, to ensure you have recent backups readily available.
8. Ongoing Monitoring and Maintenance
   Website security is an ongoing process that requires continuous monitoring and maintenance. Regularly scan your website for malware or vulnerabilities using security plugins like Wordfence. Stay informed about the latest security practices and potential threats by following reputable sources and forums dedicated to WordPress security.

Securing your WordPress website is crucial to protect your online presence, sensitive data, and maintain the trust of your visitors. By implementing strong usernames and passwords, enabling two-factor authentication, keeping WordPress and plugins up to date, choosing a secure hosting environment, limiting login attempts, utilizing security plugins like Wordfence, regularly backing up your website, and performing ongoing monitoring and maintenance, you can significantly enhance the security of your WordPress website and mitigate potential risks.

The post WordPress Website Security: Protecting Your Online Presence appeared first on Tarheel Media.

If that wasn’t bad enough, Dave’s team came across remote code execution vulnerabilities or RCE’s. RCE’s are usually where bad code allows an attacker to gain administrative or super-user privileges and entirely take over a website or the entire information system.

Dave’s team, however, focused in on the SQL injections – a way of appending your own SQL query from code that does not escape its $_POST variables which is the variable where the stuff you submit to a website is stored. After just 3 months of research, Dave’s team found a staggering 35 plugins that had already been exploited by unauthorized users or hackers. While 35 sounds like a low number, those 35 plugins were in operation and were exploited on over 60,500 WordPress websites.

“Although the vast majority of the vulnerabilities I reported were unauthenticated SQL injection vulnerabilities, which would have enabled an attacker to dump the entire WordPress database contents, these were not the most devastating ones,” Dave said.

“The sitemap-by-click5 plugin suffered from an unauthenticated arbitrary options update flaw, which would have allowed an attacker to maliciously enable the registration functionality and set the default user role to that of an administrator.”

Dave explained that this would allow an attacker to create their own administrator account and entirely take over the WordPress website. Dave went on to say that he hopes this research forwards the ability to quickly identify security exploits in the future and minimize website intrusions.

After dealing with these WordPress Plugins and WordPress.org a pretty heavy blow, Dave did applaud the WordPress team for how well the disclosure process went in allowing Dave’s team to reach out and get these updates out there to these vulnerable websites that desperately needed it.

The post Outdated WordPress Plugins make 60,000 Websites Vulnerable appeared first on Tarheel Media.