CVE-2026-104021 hostspa CVE debrief

Who should care

Administrators of WordPress installations using the Fastcache by Host.it plugin should be aware of this vulnerability and take steps to mitigate. They should verify their version and update to a patched version if available. They should also review their .htaccess files for any suspicious changes and monitor server logs for unusual activity. Additionally, they should confirm whether affected product deployments exist in managed environments and assign an

Why it matters

CVE-2026-104021 is a high-severity vulnerability in the Fastcache by Host.it plugin for WordPress, allowing authenticated administrators to inject arbitrary Apache directives into the site's .htaccess file. This could enable server-level configuration changes, such as executing attacker-controlled PHP code on every request.

• Potential for server-level configuration changes
• Possible execution of attacker-controlled PHP code on every request
• Ability to inject arbitrary Apache directives into .htaccess files

Technical summary

The Fastcache by Host.it plugin for WordPress is vulnerable to code injection in versions up to and including 1.7.4. An authenticated attacker with administrator-level access can inject arbitrary Apache directives into the site's .htaccess file via the `fastcache_settings[cache_cookie_exclude][]` parameter. This is due to the plugin registering the `cache_cookie_exclude` setting via `register_setting()` without a `sanitize_callback`, while `buildSiteHtaccessRules()` applies only `trim()` to each cookie value before interpolating it directly into an Apache `RewriteCond` line — a normalization that strips surrounding whitespace but leaves embedded newlines intact, allowing an attacker to break out of the capture

Defensive priority

Administrators of WordPress installations using the Fastcache by Host.it plugin should verify their version and update to a patched version if available. They should also review their .htaccess files for any suspicious changes.

Recommended defensive actions

• Verify the version of the Fastcache by Host.it plugin and update to a patched version if available.
• Review .htaccess files for any suspicious changes.
• Monitor server logs for unusual activity.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists in versions up to and including 1.7.4 of the Fastcache by Host.it plugin. An attacker with administrator-level access can inject arbitrary Apache directives via the `fastcache_settings[cache_cookie_exclude][]` parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.