CVE-2026-1924

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.4. This is due to missing nonce verification on the `ahsc_ajax_reset_options()` function. This makes it possible for unauthenticated attackers to reset all plugin settings to their default values via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.4/aruba-hispeed-cache.php#L631
• https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.4/aruba-hispeed-cache.php#L632
• https://plugins.trac.wordpress.org/changeset?old_path=%2Faruba-hispeed-cache/tags/3.0.4&new_path=%2Faruba-hispeed-cache/tags/3.0.5
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d2230151-fde2-43d6-8bff-0d2ffd559ab3?source=cve

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1923The Social Rocket – Social Sharing Plugin plugin for WordPre…6.4
• CVE-2026-19230A vulnerability was identified in SourceCodester Photo Share…3.5
• CVE-2026-19231A security flaw has been discovered in SourceCodester Simple…7.3
• CVE-2026-19232Adobe Experience Manager is affected by an Incorrect Authori…9.9
• CVE-2026-19233CWE-918: Server-Side Request Forgery (SSRF) vulnerability ex…8.6
• CVE-2026-19234Power Systems Firmware FW1120.00, FW1110.00 through FW1110.3…8.2
• CVE-2026-19243A security vulnerability has been detected in HKUDS nanobot …6.3
• CVE-2026-19244A vulnerability was detected in HKUDS nanobot up to 0.2.1. T…4.7
• CVE-2026-19245A flaw has been found in HKUDS nanobot up to 0.2.1. The impa…3.3
• CVE-2026-19246A vulnerability has been found in HKUDS nanobot up to 0.2.1.…6.3
• CVE-2026-19248QDomDocument XML parsing is vulnerable to a remotely-trigger…7.1
• CVE-2026-1925The EmailKit – Email Customizer for WooCommerce & WP plugin …4.3