Description
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.
Published: 2024-10-16
Score: 8 High
EPSS: 1.5% Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Apr 2026 19:45:00 +0200

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}

Sat, 12 Jul 2025 15:45:00 +0200

Type Values Removed Values Added
Metrics epss

{'score': 0.00091}

 epss

{'score': 0.00101}

Thu, 13 Mar 2025 14:45:00 +0100

Type Values Removed Values Added
Weaknesses CWE-22

Wed, 16 Oct 2024 20:15:00 +0200

Type Values Removed Values Added
First Time appeared Wpfastestcache
Wpfastestcache wp Fastest Cache
CPEs cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:*
Vendors & Products Wpfastestcache
Wpfastestcache wp Fastest Cache
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Oct 2024 09:00:00 +0200

Type Values Removed Values Added
Description The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.
Title WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Wpfastestcache Wp Fastest Cache
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:04:05.076Z

Reserved: 2024-10-15T18:35:56.151Z

Link: CVE-2020-36836

cve-icon Vulnrichment

Updated: 2024-10-16T17:49:39.364Z

cve-icon NVD

Status : Modified

Published: 2024-10-16T07:15:08.630

Modified: 2026-06-17T03:16:17.617

Link: CVE-2020-36836

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-352

    Cross-Site Request Forgery (CSRF)