WP Fastest Cache - Arbitrary File Deletion (CVE-2020-36836)
Description
The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server.
psychologyCrowdSec Analysis
CVE-2020-36836 is a vulnerability in the WP Fastest Cache plugin for WordPress that allows authenticated users with minimal permissions to delete arbitrary files from the server due to insufficient capability checks and path validation. This flaw could be exploited to disrupt website functionality, delete critical files, or facilitate further attacks on the affected WordPress installation.
CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2025.
According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2020-36836 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. CrowdSec data also reveals a clear uptick in attacks involving CVE-2020-36836 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Attackers exploit authenticated sessions to send crafted POST requests to /wp-admin/admin-ajax.php with the action=wpfc_delete_current_page_cache parameter and a manipulated path value, enabling arbitrary file deletion within the WordPress installation.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-10-16 |
| Rule Released | 2025-09-24 |
| CrowdSec First Seen | 2026-03-03 |
Related Weaknesses
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.