Arbitrary File Deletion in WP Fastest Cache

Successful exploitation allows a low-privileged authenticated user to delete arbitrary files accessible to the web application on the underlying server. This can lead to application disruption, loss of integrity and availability, deletion of WordPress or plugin files, and potentially broader service instability depending on which files are removed.

If immediate patching is not possible, restrict access to the plugin’s administrative and file-management functionality to trusted users only, minimize the number of authenticated accounts with access to the WordPress instance, and harden filesystem permissions so the web server process cannot delete sensitive application or system files beyond what is strictly necessary. Additional monitoring for unexpected file deletions and integrity changes can help detect exploitation attempts.

Update WP Fastest Cache to a version newer than 0.9.0.2 that implements proper authorization checks and robust path validation for deletion operations. The vulnerable code path should enforce capability checks before performing file operations and restrict deletions to explicitly allowed directories after canonical path validation.