What the vulnerability does
01Description
Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery (CSRF) vulnerability affecting multiple administrative AJAX actions. The handlers for ahsc_reset_options, ahsc_debug_status, and ahsc_enable_purge perform authentication and capability checks but do not verify a WordPress nonce for state-changing requests. An attacker can induce a logged-in administrator to visit a malicious webpage that submits forged requests to admin-ajax.php, resulting in unauthorized resetting of plugin settings, toggling of the WordPress WP_DEBUG configuration, or modification of cache purging behavior without the administrator’s intent.
Explanation of Vulnerability in Simple Terms
02Summary
Aruba HiSpeed Cache versions before 3.0.5 contain a cross-site request forgery (CSRF) vulnerability. An attacker can trick a site administrator into performing unintended actions by crafting a malicious link or page. The vulnerability requires the admin to click the link while logged in. Update to version 3.0.5 or later to fix this issue.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into performing unintended actions on the site via a crafted link or page.
Potential impact on your site
04Site Impact
An attacker could modify cache settings or other admin functions without the admin's knowledge if they click a malicious link.
Conditions required to exploit
05Prerequisites
Admin must click a malicious link or visit an attacker-controlled page while logged into the site.
Key dates
06Disclosure timeline
February 23, 2026
CVE published
March 5, 2026
Record updated
