CVE-2026-107763

Executive Summary

CVE-2026-107763 is an authorization bypass (CWE-862, "Missing Authorization") in the Fastcache by Host.it WordPress plugin, affecting all versions up to and including 1.7.5. Because the plugin fails to verify that a user is authorized to perform a cache-rule management action, any authenticated user with subscriber-level access or above can add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. The vulnerability is unpatched and carries a CVSS v3.1 base score of 4.3 (Low), reflecting low integrity impact with no confidentiality or availability impact.

Technical Analysis

The vulnerability class is a missing authorization check (CWE-862) on a privileged plugin action. In WordPress, actions exposed to authenticated users—particularly those reachable through admin-ajax.php or REST endpoints—must perform both a nonce check and a capability check (for example, current_user_can('manage_options')) before performing site-level changes. According to the NVD description, Fastcache by Host.it does not "properly verify that a user is authorized to perform an action," which allows a low-privileged authenticated account (subscriber and above) to invoke an operation that modifies the site's root .htaccess file.

The affected capability is management of the plugin's page-cache rewrite rules. WordPress page-cache plugins commonly write mod_rewrite directives into the root .htaccess to serve cached HTML or bypass PHP for cached pages. The action that writes or removes these rules is evidently callable by any authenticated user because the capability gate is absent or insufficient. Because the operation only adds or removes the plugin's own rewrite block, the direct integrity impact is scoped to cache behavior and web-server configuration rather than arbitrary file write.

The exact endpoint, parameter names, and function names are not disclosed in the NVD description, so they are not reproduced here. The attack surface is any WordPress installation running the affected plugin where untrusted parties can obtain subscriber-level accounts (self-registration, comment-based account provisioning, or compromised low-privilege credentials). Attack complexity is low and no user interaction is required; only network reachability and an authenticated session are needed, matching the vector AV:N/AC:L/PR:L/UI:N.

Exploitation Scenarios

1. Reconnaissance and target identification. An attacker enumerates WordPress sites and fingerprints the Fastcache by Host.it plugin (for example via plugin asset paths under /wp-content/plugins/). The attacker confirms a registration path or obtains subscriber credentials.

2. Triggering the authorization bypass. Using the authenticated session, the attacker invokes the plugin's cache-rule management action without holding the capability that action should require. Because the plugin does not verify authorization, the request is processed.

3. Rule manipulation. The plugin adds or removes its page-cache rewrite rules in the root .htaccess. This is the extent of the primitive described: the attacker cannot, per the description, insert arbitrary directives—only toggle the plugin's own rewrite block.

4. Post-exploitation impact. By removing the rewrite rules, the attacker can disable page caching, forcing dynamic generation of every request and degrading performance (cache-defeat/denial of service). By adding or re-adding them, the attacker can alter caching behavior—potentially serving stale or attacker-influenced cached content, or disrupting rule ordering relied upon by other plugins. The integrity impact is limited (CVSS I:L); availability and confidentiality are unrated in the vector.

No public PoC, exploit code, or Nuclei template is available; the chain above is inferred from the vulnerability class and NVD description.

Impact Assessment

CVSS v3.1 base score is 4.3: AV:N (remote), AC:L (no special conditions), PR:L (subscriber-level credentials), UI:N (no interaction), S:U (scope unchanged), C:N, I:L, A:N. The most material risk is integrity of the site's web-server configuration and caching layer, controlled by an untrusted low-privilege account. Practical consequences include cache-defeat performance degradation (amplifying operational cost and reducing availability), manipulation of cached responses, and interference with rewrite precedence used by other plugins or security rules. Blast radius is every visitor and downstream application relying on the affected site's cache and .htaccess. The EPSS score is not yet assigned by FIRST.org, and the CVE is not in CISA KEV. WordPress powers a large share of the web and page-cache plugins are extremely common, so exposure is broad across multi-author and membership sites where subscriber accounts are easy to obtain.

Detection Guidance

Sigma Rule

title: Fastcache by Host.it Authorization Bypass - htaccess Cache Rule Manipulation
id: 6d3b9f2e-1a4c-4e7b-9c2a-fastcache862
status: experimental
description: Detects subscriber-level users invoking Fastcache cache-rule management (CVE-2026-107763)
logsource:
  product: wordpress
  service: web
detection:
  selection_path:
    cs-uri-query|contains:
      - 'fastcache'
      - 'host_it'
  selection_action:
    cs-uri-query|contains:
      - 'action='
      - 'option='
  selection_role:
    user_role: 'subscriber'
  condition: selection_path and selection_action and selection_role
falsepositives:
  - Administrative cache management by legitimately authorized users
level: medium

YARA Rule

rule CVE_2026_107763_Fastcache_Host_it_AuthBypass
{
    meta:
        description = "Detects Fastcache by Host.it plugin references and htaccess cache-rule manipulation indicators"
        cve = "CVE-2026-107763"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107763"
        author = "valtersit.com"
    strings:
        $plugin = "fastcache-by-host-it" ascii wide nocase
        $htaccess = ".htaccess" ascii
        $rule_add = /RewriteRule.*fastcache/i
        $rule_cond = /RewriteCond.*fastcache/i
    condition:
        uint32(0) == 0x464c457f or
        ($plugin and $htaccess and 1 of ($rule_*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107763 Fastcache Host.it auth bypass - cache rule manipulation"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"fastcache"; nocase; http.uri; content:"action"; nocase; reference:cve,2026-107763; classtype:attempted-user; sid:2026107763; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST" and url.path : "*fastcache*"]
  [file where event.action in ("modification","change") and file.path : "*.htaccess"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_fastcache=if(match(uri, "(?i)fastcache|host_it"), 1, 0)
| eval is_action=if(match(uri, "(?i)action=|option="), 1, 0)
| where is_fastcache=1 AND is_action=1
| stats count values(uri) as uris by src_ip, status
| where count > 3

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-107763">
  <rule id="107763" level="8">
    <if_sid>31100</if_sid>
    <match>fastcache</match>
    <regex type="pcre2">(?i)action=|option=</regex>
    <description>CVE-2026-107763: Fastcache by Host.it cache-rule manipulation request detected</description>
    <mitre>
      <id>T1562</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — unpatched, with no vendor fix from any tracked source.

1. Immediate mitigations. Restrict or disable public registration and audit low-privilege accounts. If practical, deactivate the Fastcache by Host.it plugin until a fix is available, or front the site with a caching layer that does not depend on .htaccess rewrites. Enforce strict capability review of any plugin management endpoints reachable by subscribers, and monitor logs for subscriber accounts invoking cache-rule actions.
2. Patch/upgrade steps. No patch exists for versions <= 1.7.5. Monitor the vendor for a release and upgrade as soon as available; until then treat the plugin as at-risk and remove it where possible.
3. Long-term hardening. Enforce least privilege and strict capability/nonce checks on all custom plugin actions; regularly audit the root .htaccess for unauthorized rewrite changes; implement integrity monitoring and WAF rules targeting unauthorized plugin action requests.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-107763
• MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1562 (Impair Defenses): https://attack.mitre.org/techniques/T1562/
• WordPress Plugin Security Handbook (capability/nonce verification): https://developer.wordpress.org/plugins/security/
• No threat actor campaigns or in-the-wild exploitation evidence have been reported; CVE not listed in CISA KEV.