PT-2026-20574 · WordPress · Aruba Hispeed Cache

Michael Mazzolini · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-11725

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Aruba HiSpeed Cache versions up to and including 3.0.2

Description The Aruba HiSpeed Cache plugin for WordPress is susceptible to unauthorized data modification because of absent capability checks in several functions. This allows unauthenticated attackers to alter the plugin’s configuration, activate or deactivate features, and control WordPress cron jobs or debug mode.

Recommendations Update Aruba HiSpeed Cache to a version later than 3.0.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11725

Affected Products

Aruba Hispeed Cache

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11725 · Security Note
• https://twitter.com/CVEnew/status/2025892103750922263 · Twitter Post
• https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.1/aruba-hispeed-cache.php#L618 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399636%40aruba-hispeed-cache&new=3399636%40aruba-hispeed-cache&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2830c958-13d1-4c69-8dde-7fc091db02eb?source=cve · Note
• https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.1/aruba-hispeed-cache.php#L590 · Note
• https://t.me/CVEtracker/45047 · Telegram Post