{"api_version":"1","generated_at":"2026-07-23T04:29:52+00:00","cve":"CVE-2015-4089","urls":{"html":"https://cve.report/CVE-2015-4089","api":"https://cve.report/api/cve/CVE-2015-4089.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-4089","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-4089"},"summary":{"title":"CVE-2015-4089","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2017-09-19 15:29:00","updated_at":"2019-09-01 06:15:00"},"problem_types":["CWE-352"],"metrics":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2015/05/26/20","name":"[oss-security] 20150526 Re: CVE Request for WP Fastest Cache plugin","refsource":"MLIST","tags":["Mailing List","Third Party Advisory"],"title":"oss-security - Re: CVE Request for WP Fastest Cache plugin","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://wpvulndb.com/vulnerabilities/9756","name":"https://wpvulndb.com/vulnerabilities/9756","refsource":"MISC","tags":[],"title":"WP Fastest Cache < 0.8.3.5 - Multiple CSRF","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"https://wordpress.org/plugins/wp-fastest-cache/#developers","name":"https://wordpress.org/plugins/wp-fastest-cache/#developers","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"WordPress › WP Fastest Cache « WordPress Plugins","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-4089","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-4089","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"4089","vulnerable":"1","versionEndIncluding":"0.8.3.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"wpfastestcache","cpe5":"wp_fastest_cache","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-4089","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://wordpress.org/plugins/wp-fastest-cache/#developers","refsource":"CONFIRM","url":"https://wordpress.org/plugins/wp-fastest-cache/#developers"},{"name":"[oss-security] 20150526 Re: CVE Request for WP Fastest Cache plugin","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2015/05/26/20"},{"refsource":"MISC","name":"https://wpvulndb.com/vulnerabilities/9756","url":"https://wpvulndb.com/vulnerabilities/9756"}]}},"nvd":{"publishedDate":"2017-09-19 15:29:00","lastModifiedDate":"2019-09-01 06:15:00","problem_types":["CWE-352"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:wpfastestcache:wp_fastest_cache:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"0.8.3.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"4089","Ordinal":"81057","Title":"CVE-2015-4089","CVE":"CVE-2015-4089","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"4089","Ordinal":"1","NoteData":"Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.","Type":"Description","Title":null},{"CveYear":"2015","CveId":"4089","Ordinal":"2","NoteData":"2017-09-19","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"4089","Ordinal":"3","NoteData":"2019-09-01","Type":"Other","Title":"Modified"}]}}}