El plugin Aruba HiSpeed Cache para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 3.0.4, incluyendo esta. Esto se debe a la falta de verificación de nonce en la función `ahsc_ajax_reset_options()`. Esto permite a atacantes no autenticados restablecer todas las configuraciones del plugin a sus valores predeterminados a través de una solicitud falsificada, siempre y cuando puedan engañar a un administrador del sitio para que realice una acción, como hacer clic en un enlace.

Successful exploitation of this CSRF vulnerability allows an attacker to completely reset the Aruba HiSpeed Cache plugin's configuration to its default values. This can disrupt caching functionality, potentially impacting website performance and user experience. While the impact isn't directly data theft or system compromise, it can be used as a diversionary tactic or to cause denial-of-service-like effects by disabling caching. The attacker needs to craft a malicious link or form that, when accessed by an administrator, triggers the settings reset without their knowledge.

Websites utilizing the Aruba HiSpeed Cache plugin, particularly those with shared hosting environments or where plugin updates are not performed regularly, are at risk. WordPress administrators who routinely click on links from untrusted sources are also vulnerable.

• wordpress / composer / npm:

grep -r 'ahsc_ajax_reset_options()' /var/www/html/wp-content/plugins/aruba-hispeed-cache/

• wordpress / composer / npm:

wp plugin list --status=all | grep aruba-hispeed-cache

• wordpress / composer / npm:

wp plugin update aruba-hispeed-cache --all

1. 2026-04-10Disclosure

   disclosure

1. Reservado2026-02-04
2. Publicada2026-04-10
3. Modificada2026-04-13
4. EPSS actualizado2026-04-17

The primary mitigation is to immediately upgrade the Aruba HiSpeed Cache plugin to version 3.0.5 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the ahscajaxreset_options() endpoint that lack proper nonce verification. Alternatively, restrict access to the plugin's administrative interface to trusted users only. Regularly audit WordPress plugin configurations for any unusual changes.