CVE-2026-104021: Code Injection di Fastcache Host.it

CVE ID	CVE-2026-104021
Severity	HIGH — CVSS CVSS V3.1 7.2
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-94 CWE-94 Improper Control of Generation of Code ('Code Injection')
Produk	hostspa / Fastcache by Host.it — 0 (affected)
Dipublikasikan	2026-10-10

Ringkasan Cepat

• CVE-2026-104021 adalah kerentanan code injection pada plugin WordPress Fastcache by Host.it versi hingga 1.7.4.
• Penyebabnya: setting cache_cookie_exclude didaftarkan tanpa sanitize_callback, lalu nilai cookie hanya di-trim() sebelum dimasukkan ke direktif Apache RewriteCond.
• Penyerang dengan akses administrator-level dan di atasnya dapat menyuntikkan direktif Apache ke .htaccess dan berpotensi mengeksekusi PHP lewat php_value auto_prepend_file.

Ringkasan Kerentanan

CVE-2026-104021 adalah kerentanan code injection pada plugin WordPress Fastcache by Host.it hingga versi 1.7.4. Deskripsi resmi menyebut masalah muncul melalui parameter fastcache_settings[cache_cookie_exclude][].

Penyebabnya, plugin mendaftarkan setting cache_cookie_exclude dengan register_setting() tanpa sanitize_callback. Fungsi buildSiteHtaccessRules() hanya menerapkan trim() pada setiap nilai cookie sebelum menginterpolasikannya langsung ke baris RewriteCond Apache. Normalisasi ini menghapus spasi di sekitar nilai, tetapi tidak menghapus newline yang tertanam, sehingga penyerang dapat keluar dari capture group dan menambahkan direktif arbitrer.

Kerentanan masuk kategori CWE-94 Improper Control of Generation of Code atau code injection.

Dampak Teknis

Dengan akses administrator-level dan di atasnya, penyerang dapat menyuntikkan direktif Apache arbitrer ke file .htaccess situs melalui file_put_contents(). Ini memungkinkan perubahan konfigurasi di level server.

Salah satu dampak yang disebutkan adalah penyerang dapat menyetel php_value auto_prepend_file untuk mengeksekusi kode PHP yang dikendalikan penyerang pada setiap request. Severity dinilai HIGH 7.2 dengan vektor CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, serta kategori CWE-94 Improper Control of Generation of Code.

Produk Terdampak

Produk yang terdampak adalah plugin WordPress Fastcache by Host.it dari vendor hostspa. Judul CNA menegaskan semua versi hingga dan termasuk 1.7.4 rentan.

• Vendor: hostspa
• Produk: Fastcache by Host.it
• Versi terdampak: hingga 1.7.4
• Platform: WordPress

Konteks, Publikasi, dan Referensi

Kerentanan ini dipublikasikan pada 2026-10-10T04:26:48.359Z. Referensi resmi berasal dari Wordfence Threat Intel dengan ID d72d7a21-0bea-4a32-b92b-326f47998b80 serta repositori plugin Trac WordPress, termasuk berkas Utility.php baris 545, 420, 521, Dispatcher.php baris 480, dan Admin.php baris 73.

Dari sudut pertahanan, kasus ini menegaskan pentingnya sanitasi input saat pengaturan disimpan, terutama bila nilainya dimasukkan ke file konfigurasi server seperti .htaccess. Validasi newline dan karakter kontrol menjadi kontrol kunci.

Mitigasi dan Perbaikan

• Pantau dan terapkan pembaruan resmi plugin Fastcache by Host.it. Karena semua versi hingga 1.7.4 terdampak, jangan tetap di versi tersebut jika vendor merilis perbaikan.
• Jika patch belum tersedia, nonaktifkan sementara plugin Fastcache by Host.it sampai ada versi aman.
• Audit dan bandingkan file .htaccess dengan backup; hapus direktif tidak dikenal, terutama php_value auto_prepend_file, dan periksa perubahan file melalui monitoring integritas.
• Batasi dan audit akun administrator WordPress. Terapkan least privilege, MFA, dan hapus akun admin yang tidak digunakan.
• Pantau log perubahan file dan request mencurigakan; gunakan integritas file untuk mendeteksi modifikasi .htaccess dan file PHP.

Referensi Resmi

• CVE-2026-104021 — CVE Program (cve.org)
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d72d7a21-0bea-4a32-b92b-326f47998b80?source=cve
• https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Core/Platform/Utility.php#L545
• https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Core/Platform/Utility.php#L420
• https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Core/Platform/Utility.php#L521
• https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Dispatcher.php#L480
• https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Admin.php#L73

Artikel ini disusun dari data publik CVE Program (cve.org). Selalu verifikasi patch resmi dari vendor sebelum menerapkan perubahan.

Pertanyaan yang Sering Diajukan (FAQ)

Apa itu CVE-2026-104021?

CVE-2026-104021 adalah kerentanan code injection pada plugin WordPress Fastcache by Host.it hingga versi 1.7.4 melalui parameter fastcache_settings[cache_cookie_exclude][]. Kategorinya CWE-94 dengan severity HIGH 7.2.

Siapa yang dapat mengeksploitasi kerentanan ini?

Pihak yang memerlukan akses authenticated dengan administrator-level dan di atasnya. Ini bukan serangan yang dapat dilakukan tanpa login.

Apa dampak utama kerentanan ini?

Penyerang dapat menyuntikkan direktif Apache arbitrer ke file .htaccess melalui file_put_contents(). Dampak yang disebutkan mencakup penyetelan php_value auto_prepend_file untuk mengeksekusi kode PHP pada setiap request.

Versi Fastcache by Host.it mana yang terdampak?

Semua versi hingga dan termasuk 1.7.4 terdampak menurut judul CNA dan deskripsi resmi.

Apakah sudah ada patch resmi?

Dalam fakta yang tersedia belum disebutkan versi perbaikan. Informasi yang ada hanya menyatakan versi hingga 1.7.4 terdampak, sehingga pembaruan resmi vendor perlu dipantau.

Apa mitigasi sementara jika patch belum tersedia?

Nonaktifkan plugin sementara, audit .htaccess terhadap direktif mencurigakan, batasi akun administrator, dan aktifkan pemantauan integritas file untuk mendeteksi perubahan tidak sah.

English Version — CVE-2026-104021: Code Injection in Fastcache by Host.it

Quick Summary

• CVE-2026-104021 is a code injection vulnerability in the WordPress plugin Fastcache by Host.it versions up to 1.7.4.
• The cause: the cache_cookie_exclude setting is registered without a sanitize_callback, and cookie values are only trim()ed before being inserted into Apache RewriteCond directives.
• An attacker with administrator-level access or higher can inject Apache directives into .htaccess and potentially execute PHP via php_value auto_prepend_file.

Vulnerability Summary

CVE-2026-104021 is a code injection vulnerability in the WordPress plugin Fastcache by Host.it up to version 1.7.4. The official description states that the issue arises through the fastcache_settings[cache_cookie_exclude][] parameter.

The cause is that the plugin registers the cache_cookie_exclude setting with register_setting() without a sanitize_callback. The buildSiteHtaccessRules() function only applies trim() to each cookie value before interpolating it directly into an Apache RewriteCond line. This normalization removes whitespace around the value but does not remove embedded newlines, allowing an attacker to break out of the capture group and add arbitrary directives.

The vulnerability falls under CWE-94 Improper Control of Generation of Code, or code injection.

Technical Impact

With administrator-level access or higher, an attacker can inject arbitrary Apache directives into the site's .htaccess file via file_put_contents(). This allows changes to server-level configuration.

One of the stated impacts is that an attacker can set php_value auto_prepend_file to execute attacker-controlled PHP code on every request. The severity is rated HIGH 7.2 with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and the category is CWE-94 Improper Control of Generation of Code.

Affected Products

The affected product is the WordPress plugin Fastcache by Host.it from vendor hostspa. The CNA title states that all versions up to and including 1.7.4 are vulnerable.

• Vendor: hostspa
• Product: Fastcache by Host.it
• Affected version: up to 1.7.4
• Platform: WordPress

Context, Publication, and References

This vulnerability was published on 2026-10-10T04:26:48.359Z. Official references come from Wordfence Threat Intel with ID d72d7a21-0bea-4a32-b92b-326f47998b80 and the WordPress plugin Trac repository, including the files Utility.php lines 545, 420, 521, Dispatcher.php line 480, and Admin.php line 73.

From a defensive perspective, this case underscores the importance of input sanitization when settings are saved, especially when the values are inserted into server configuration files such as .htaccess. Validating newlines and control characters is a key control.

Mitigation

• Monitor and apply official updates for the Fastcache by Host.it plugin. Because all versions up to 1.7.4 are affected, do not remain on those versions if the vendor releases a fix.
• If no patch is available, temporarily disable the Fastcache by Host.it plugin until a safe version is available.
• Audit and compare .htaccess files with backups; remove unknown directives, especially php_value auto_prepend_file, and check for file changes through integrity monitoring.
• Restrict and audit WordPress administrator accounts. Enforce least privilege, MFA, and remove unused admin accounts.
• Monitor file change logs and suspicious requests; use file integrity monitoring to detect modifications to .htaccess and PHP files.

FAQ (English)

What is CVE-2026-104021?

CVE-2026-104021 is a code injection vulnerability in the WordPress plugin Fastcache by Host.it up to version 1.7.4 through the fastcache_settings[cache_cookie_exclude][] parameter. Its category is CWE-94 with a severity of HIGH 7.2.

Who can exploit this vulnerability?

It requires authenticated access with administrator-level privileges or higher. This is not an attack that can be performed without logging in.

What is the main impact of this vulnerability?

An attacker can inject arbitrary Apache directives into the .htaccess file via file_put_contents(). The stated impact includes setting php_value auto_prepend_file to execute PHP code on every request.

Which versions of Fastcache by Host.it are affected?

All versions up to and including 1.7.4 are affected according to the CNA title and official description.

Is there an official patch?

The available facts do not mention a fixed version. The available information only states that versions up to 1.7.4 are affected, so the vendor's official updates should be monitored.

What temporary mitigations are available if no patch is available?

Temporarily disable the plugin, audit .htaccess for suspicious directives, restrict administrator accounts, and enable file integrity monitoring to detect unauthorized changes.