PT-2026-20574 · WordPress · Aruba Hispeed Cache

Michael Mazzolini · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2025-11725

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Aruba HiSpeed Cache versions up to and including 3.0.2

Description The Aruba HiSpeed Cache plugin for WordPress is susceptible to unauthorized data modification because of absent capability checks in several functions. This allows unauthenticated attackers to alter the plugin’s configuration, activate or deactivate features, and control WordPress cron jobs or debug mode.

Recommendations Update Aruba HiSpeed Cache to a version later than 3.0.2.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-11725

Produtos afetados

Aruba Hispeed Cache

Referências · 7

• https://twitter.com/CVEnew/status/2025892103750922263 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.1/aruba-hispeed-cache.php#L618 · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399636%40aruba-hispeed-cache&new=3399636%40aruba-hispeed-cache&sfp_email=&sfph_mail= · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-11725 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/2830c958-13d1-4c69-8dde-7fc091db02eb?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.1/aruba-hispeed-cache.php#L590 · Nota
• https://t.me/CVEtracker/45047 · Publicação no Telegram