PT-2026-21555 · WordPress · Aruba Hispeed Cache

Rahul Karne + 1 · Published 2026-02-23 · Updated 2026-02-24 · CVE-2026-23694

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Aruba HiSpeed Cache WordPress plugin versions prior to 3.0.5

Description The Aruba HiSpeed Cache WordPress plugin is susceptible to a cross-site request forgery (CSRF) issue impacting several administrative AJAX actions. Specifically, the ahsc reset options, ahsc debug status, and ahsc enable purge handlers authenticate and check user capabilities but fail to validate a WordPress nonce for requests that alter the system's state. An attacker could potentially trick a logged-in administrator into visiting a malicious webpage, causing the submission of forged requests to the admin-ajax.php endpoint. This could lead to unauthorized changes, such as resetting plugin settings, modifying the WordPress WP DEBUG configuration, or altering cache purging behavior. The vulnerable parameters are not explicitly mentioned.

Recommendations Update Aruba HiSpeed Cache WordPress plugin to version 3.0.5 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-23694

Affected Products

Aruba Hispeed Cache

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-23694 · Security Note
• https://wordpress.org/plugins/aruba-hispeed-cache · Patch
• https://hosting.aruba.it/en/wordpress.aspx · Note
• https://twitter.com/CVEnew/status/2026265026542133611 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026064252658725176 · Twitter Post
• https://t.me/CVEtracker/45517 · Telegram Post