Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Aruba HiSpeed Cache plugin for WordPress allows unauthorized settings reset

CVE-2026-1924
Summary

An attacker can trick a site administrator into resetting plugin settings to their default values without permission. This can happen if the administrator clicks on a malicious link. To fix this, update the plugin to the latest version, version 3.0.5 or higher.

Original title
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing nonce verification on the `ahsc_ajax_res...
Original description
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing nonce verification on the `ahsc_ajax_reset_options()` function. This makes it possible for unauthenticated attackers to reset all plugin settings to their default values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
nvd CVSS3.1 4.3
Vulnerability type
CWE-352 Cross-Site Request Forgery (CSRF)
Published: 10 Apr 2026 · Updated: 10 Apr 2026 · First seen: 10 Apr 2026