CVE-2026-104021: Fastcache by Host.it 0 through 1.7.4

Affected technology

Fastcache by Host.it · 0 through 1.7.4
hostspa

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

The source says this is due to the plugin registering the `cache_cookie_exclude` setting via `register_setting()` without a `sanitize_callback`, while `buildSiteHtaccessRules()` applies only `trim()` to each cookie value before interpolating it directly into an Apache `RewriteCond` line — a normalization that strips surrounding whitespace but leaves embedded newlines intact, allowing an attacker to break out of the capture group and append arbitrary directives. Vendor/CNA’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high.