Plugin security history

WP Fastest Cache – WordPress Cache Plugin Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 35 vulnerability records associated with WP Fastest Cache – WordPress Cache Plugin, published between 2015 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

35Total records

3Critical

9High

23Medium

0Low

0Informational

35Patched records

0Currently marked unpatched

2015-05-26First disclosure

2025-11-26Latest disclosure

31 of 35CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2015	2	2 records
2016	3	3 records
2018	5	5 records
2019	1	1 records
2020	1	1 records
2021	3	3 records
2022	1	1 records
2023	17	17 records
2024	1	1 records
2025	1	1 records

Severity Breakdown

Severity	Records	Share
Critical	3	8.6%
High	9	25.7%
Medium	23	65.7%

Vulnerability-Type Breakdown

CSRF

14 records40%

First: 2015. Latest: 2023.

Missing Authorization

7 records20%

First: 2016. Latest: 2025.

SQL Injection

4 records11.4%

First: 2015. Latest: 2023.

Path Traversal

4 records11.4%

First: 2019. Latest: 2024.

Other

3 records8.6%

First: 2016. Latest: 2023.

Cross-Site Scripting

3 records8.6%

First: 2018. Latest: 2018.

Patch Status

Patched: 35
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.4.1
1.2.7
1.2.2
1.1.5
1.1.3
0.8.9.1
0.9.5
0.9.1.7
0.9.0.3
0.8.9.6
0.8.8.6
0.8.7.5
0.8.6.0
0.8.5.8
0.8.4.9
0.8.3.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-1.4.0`	WP Fastest Cache <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions	November 26, 2025	1.4.1	Medium
`*-1.2.6`	WP Fastest Cache <= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletion	May 10, 2024	1.2.7	High
`*-1.2.1`	WP Fastest Cache <= 1.2.1 - Unauthenticated SQL Injection	November 13, 2023	1.2.2	Critical
`*-1.1.4`	WP Fastest Cache <= 1.1.4 - Authenticated(Administrator+) Blind Server Side Request Forgery via check_url	May 2, 2023	1.1.5	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_purgecache_varnish_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_clear_cache_of_allsites_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'deleteCacheToolbar'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Missing Authorization in 'deleteCssAndJsCacheToolbar'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Missing Authorization to Cache Deletion	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_toolbar_save_settings_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_pause_cdn_integration_ajax_request_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_preload_single_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'deleteCssAndJsCacheToolbar'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_remove_cdn_integration_ajax_request_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Missing Authorization in 'wpfc_purgecache_varnish_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_start_cdn_integration_ajax_request_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_clear_cache_of_allsites_callback'	April 6, 2023	1.1.3	Medium
`*-1.1.2`	WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_save_settings_callback'	April 6, 2023	1.1.3	Medium
`*-0.8.9.0`	WP Fastest Cache <= 0.8.9.0 - Directory Traversal to Arbitrary File Deletion	January 24, 2022	0.8.9.1	Medium
`[*, 0.9.5)`	WP Fastest Cache < 0.9.5 - Authenticated (Subscriber+) SQL Injection	October 14, 2021	0.9.5	High
`[*, 0.9.5)`	WP Fastest Cache < 0.9.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting	October 14, 2021	0.9.5	High
`[*, 0.9.1.7)`	WP Fastest Cache <= 0.9.1.6 - Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion	April 27, 2021	0.9.1.7	Medium
`[*, 0.9.0.3)`	WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion	February 5, 2020	0.9.0.3	High
`*-0.8.9.5`	WP Fastest Cache <= 0.8.9.5 - Directory Traversal	July 28, 2019	0.8.9.6	Critical

Selected source records

Latest Records

MediumCVE-2025-10476

WP Fastest Cache <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions

Published: November 26, 2025

Affected versions: *-1.4.0
Patched versions: 1.4.1

Original Wordfence record

HighCVE-2024-4347

WP Fastest Cache <= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletion

Published: May 10, 2024

Affected versions: *-1.2.6
Patched versions: 1.2.7

Original Wordfence record

CriticalCVE-2023-6063

WP Fastest Cache <= 1.2.1 - Unauthenticated SQL Injection

Published: November 13, 2023

Affected versions: *-1.2.1
Patched versions: 1.2.2

Original Wordfence record

MediumCVE-2023-1938

WP Fastest Cache <= 1.1.4 - Authenticated(Administrator+) Blind Server Side Request Forgery via check_url

Published: May 2, 2023

Affected versions: *-1.1.4
Patched versions: 1.1.5

Original Wordfence record

MediumCVE-2023-1919

WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_save_settings_callback'

Published: April 6, 2023

Affected versions: *-1.1.2
Patched versions: 1.1.3

Original Wordfence record

MediumCVE-2023-1925

WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_clear_cache_of_allsites_callback'

Published: April 6, 2023

Affected versions: *-1.1.2
Patched versions: 1.1.3

Original Wordfence record

MediumCVE-2023-1921

WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_start_cdn_integration_ajax_request_callback'

Published: April 6, 2023

Affected versions: *-1.1.2
Patched versions: 1.1.3

Original Wordfence record

MediumCVE-2023-1918

WP Fastest Cache <= 1.1.2 - Cross-Site Request Forgery via 'wpfc_preload_single_callback'

Published: April 6, 2023

Affected versions: *-1.1.2
Patched versions: 1.1.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-6063

WP Fastest Cache <= 1.2.1 - Unauthenticated SQL Injection

Published: November 13, 2023

Affected versions: *-1.2.1
Patched versions: 1.2.2

Original Wordfence record

CriticalCVE-2015-9316

WP Fastest Cache < 0.8.4.9 - SQL Injection

Published: November 11, 2015

Affected versions: [*, 0.8.4.9)
Patched versions: 0.8.4.9

Original Wordfence record

CriticalCVE-2019-13635

WP Fastest Cache <= 0.8.9.5 - Directory Traversal

Published: July 28, 2019

Affected versions: *-0.8.9.5
Patched versions: 0.8.9.6

Original Wordfence record

HighCVE-2021-24870

WP Fastest Cache < 0.9.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published: October 14, 2021

Affected versions: [*, 0.9.5)
Patched versions: 0.9.5

Original Wordfence record

High

WP Fastest Cache <= 0.8.5.7 - Local File Inclusion

Published: May 24, 2016

Affected versions: *-0.8.5.7
Patched versions: 0.8.5.8

Original Wordfence record

HighCVE-2018-17584

WP Fastest Cache <= 0.8.8.5 - Cross-Site Request Forgery via page to wpfastestcacheoptions

Published: October 9, 2018

Affected versions: *-0.8.8.5
Patched versions: 0.8.8.6

Original Wordfence record

HighCVE-2021-24869

WP Fastest Cache < 0.9.5 - Authenticated (Subscriber+) SQL Injection

Published: October 14, 2021

Affected versions: [*, 0.9.5)
Patched versions: 0.9.5

Original Wordfence record

HighCVE-2015-4089

WP Fastest Cache < 0.8.3.5 - Multiple Cross-Site Request Forgery

Published: May 26, 2015

Affected versions: [*, 0.8.3.5)
Patched versions: 0.8.3.5

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory