Code Injection in WordPress Apache (CVE-2026-104021)
Summary
Code injection in WordPress Apache (CVE-2026-104021). Successful exploitation can lead to full system takeover. Exploitable via cache_cookie_exclude.
Original description
The description as published by the source.
The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcache_settings[cache_cookie_exclude][] parameter. This is due to the plugin registering the cache_cookie_exclude setting via register_setting() without a sanitize_callback, while buildSiteHtaccessRules() applies only trim() to each cookie value before interpolating it directly into an Apache RewriteCond line — a normalization that strips surrounding whitespace but leaves embedded newlines intact, allowing an attacker to break out of the capture group and append arbitrary directives. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary Apache directives into the site's .htaccess file via file_put_contents(), enabling server-level configuration changes such as setting php_value auto_prepend_file to execute attacker-controlled PHP code on every request.
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-104021 has been found in WordPress Apache.
Attackers can target a specific entry point like cache_cookie_exclude over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 7.2/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "WordPress Apache CVE-2026-104021" on the vendor's site.
CVE-2026-104021 (WordPress Apache) — CWE-94 / CVSS v3 7.2
Attack vector: remote (network-reachable) / no user interaction
Attack surface: cache_cookie_exclude / sanitize_callback / RewriteCond
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Arbitrary code execution (CWE-94) exists in WordPress Apache. Attackers reach the vulnerable code path via cache_cookie_exclude.
Check the vendor advisory for the affected versions of WordPress Apache. Attack surface: cache_cookie_exclude / sanitize_callback / RewriteCond.
Severity: High (CVSS 7.2/10). Successful exploitation can lead to full system takeover.
Update to the patched release per vendor advisory.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'Apache' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'Apache' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
Apacheを grep し、稼働しているサービス・バージョンを把握する。 -
2Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
References
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web security@wordfence.com
- web nvd.nist.gov
- web github.com