CVE-2026-23694 Aruba HiSpeed Cache < 3.0.5 CSRF in Multiple Administrative AJAX Actions
Attackers can trick administrators into resetting plugin settings or modifying cache behavior via forged requests due to missing nonce verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-23694?
CVE-2026-23694 is a medium-severity vulnerability in Aruba.it Aruba HiSpeed Cache, published on 23 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery (CSRF) vulnerability affecting multiple administrative AJAX actions. The handlers for ahsc_reset_options, ahsc_debug_status, and ahsc_enable_purge perform authentication and capability checks but do not verify a WordPress nonce for state-changing requests. An attacker can induce a logged-in administrator to visit a malicious webpage that submits forged requests to admin-ajax.php, resulting in unauthorized resetting of plugin settings, toggling of the WordPress WP_DEBUG configuration, or modification of cache purging behavior without the administrator’s intent.
Weakness: CWE-352
Which versions are affected by CVE-2026-23694?
How do I fix CVE-2026-23694?
No fix has been published for CVE-2026-23694 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-23694 being exploited?
There is no known exploitation of CVE-2026-23694 in the wild and no public exploit code.
Sources
Also known as GHSA-7mg3-vfc7-xvch.