CVE-2025-10476

Vulnerability

Details

The WP Fastest Cache plugin for WordPress fails to perform a capability check in the wpfc_db_fix_callback() AJAX function. This oversight allows authenticated users with at least Subscriber-level access to initiate several database fix actions without proper authorization [1].

Exploitation

An attacker logged into WordPress with Subscriber privileges can trigger this vulnerability by sending a crafted request to the vulnerable AJAX endpoint. The type parameter specifies which cleanup operation to perform, such as deleting content revisions, trashed items, spam comments, or transient data [1]. No additional privileges are required beyond the default Subscriber role.

Impact

Successful exploitation results in unauthorized modification of database data, leading to loss of content history, removal of legitimate comments, and potential disruption of site functionality. This can degrade site integrity and availability, requiring administrative intervention to restore normal operations [1].

Mitigation

The vulnerability affects all versions up to and including 1.4.0. Users are advised to update to the latest patched version as soon as possible. According to the advisory, the issue only impacts sites with the premium version activated [1].