Vulnerability · Published Feb 23, 2026 · Assigned by VulnCheck

CVE-2026-23694Aruba HiSpeed Cache < 3.0.5 CSRF in Multiple Administrative AJAX Actions

Medium 5.1

In plain English

A medium-severity cross-site request forgery in Aruba HiSpeed Cache from Aruba.it. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 82.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery (CSRF) vulnerability affecting multiple administrative AJAX actions. The handlers for ahsc_reset_options, ahsc_debug_status, and ahsc_enable_purge perform authentication and capability checks but do not verify a WordPress nonce for state-changing requests. An attacker can induce a logged-in administrator to visit a malicious webpage that submits forged requests to admin-ajax.php, resulting in unauthorized resetting of plugin settings, toggling of the WordPress WP_DEBUG configuration, or modification of cache purging behavior without the administrator’s intent.

Affected products (as reported)

Vendor	Product	Versions
Aruba.it	Aruba HiSpeed Cache	0 – before 3.0.5

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://wordpress.org/plugins/aruba-hispeed-cache/ product, patch
https://hosting.aruba.it/en/wordpress.aspx product