Cache Enabler WordPress plugin: Unauthenticated arbitrary file and directory deletion
Summary
The Cache Enabler WordPress plugin does not validate a URL before using it to build a filesystem path during cache purging and does not restrict deletion to the cache directory. An unauthenticated attacker can therefore delete arbitrary files and directories on the web server, which can break the website or the server. The flaw is also reachable where another installed plugin passes a request-supplied URL to the public cache-clearing hook. No public exploit code or exploitation in the wild has been confirmed at the time of writing.
Affected
- Cache Enabler WordPress plugin before 1.8.17 (WPScan: affected up to 1.8.16)
- Sites where another plugin passes request-supplied URLs to the Cache Enabler cache-clearing hook (also affected if that plugin is before 1.8.17 or otherwise vulnerable)
Fixed in
- Cache Enabler 1.8.17
- Backports to older branches: Unknown.
Workaround
- No vendor workaround published.
- Take a full backup before any changes.
- Check whether other plugins or themes pass request-supplied URLs to the Cache Enabler cache-clearing function.
- Deactivating the plugin does not remove existing cache files; verify the installed version instead.
- Virtual patching via WAF: Unknown, not verified.
Exploitation
- Exploited in the wild: No evidence found; not listed in CISA KEV at the time of research.
- Public PoC: None confirmed; a WPScan exploit reference is unverified.
- CISA SSVC: Exploitation none, automatable no, technical impact partial.
Our recommendation
- Update Cache Enabler to version 1.8.17 or later as soon as possible.
- Check all WordPress sites for the plugin and its version, including sites where it is not in active use.
- Review other plugins for code that calls the Cache Enabler cache-clearing hook with request-supplied URLs.
- Make sure current backups exist and that restores have been tested.
- Monitor web server logs for unusual requests to cache-clearing endpoints and for missing files.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- WordPress.org plugin page and changelog wordpress.org
- VulDB vuldb.com
- OpenCVE app.opencve.io
- WPScan product page wpscan.com
- CVE threatint record cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:23.
Original description (NVD)
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to its public cache-clearing hook.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.